summaryrefslogtreecommitdiffstats
path: root/kernel/irq
diff options
context:
space:
mode:
authorPrasad Sodagudi <psodagud@codeaurora.org>2019-03-24 07:57:04 -0700
committerThomas Gleixner <tglx@linutronix.de>2019-03-24 22:13:17 +0100
commit59c39840f5abf4a71e1810a8da71aaccd6c17d26 (patch)
treec0590b6b701c9ad5377e5202e903397a9deefc8c /kernel/irq
parent8c2ffd9174779014c3fe1f96d9dc3641d9175f00 (diff)
downloadlinux-59c39840f5abf4a71e1810a8da71aaccd6c17d26.tar.bz2
genirq: Prevent use-after-free and work list corruption
When irq_set_affinity_notifier() replaces the notifier, then the reference count on the old notifier is dropped which causes it to be freed. But nothing ensures that the old notifier is not longer queued in the work list. If it is queued this results in a use after free and possibly in work list corruption. Ensure that the work is canceled before the reference is dropped. Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: marc.zyngier@arm.com Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeaurora.org
Diffstat (limited to 'kernel/irq')
-rw-r--r--kernel/irq/manage.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 1401afa0d58a..53a081392115 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -357,8 +357,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
desc->affinity_notify = notify;
raw_spin_unlock_irqrestore(&desc->lock, flags);
- if (old_notify)
+ if (old_notify) {
+ cancel_work_sync(&old_notify->work);
kref_put(&old_notify->kref, old_notify->release);
+ }
return 0;
}