summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorPrasad Sodagudi <psodagud@codeaurora.org>2019-03-24 07:57:04 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-05-16 19:45:04 +0200
commit1aec586c25ee8be91afb07cbaed74cf94b827b79 (patch)
tree4b99d976c47dd1d1f528ee0bc09c9fab20c095a2 /kernel
parent2984aa6d4a7857b0525e9a46d1d6310403c4ce6c (diff)
downloadlinux-stable-1aec586c25ee8be91afb07cbaed74cf94b827b79.tar.gz
linux-stable-1aec586c25ee8be91afb07cbaed74cf94b827b79.tar.bz2
linux-stable-1aec586c25ee8be91afb07cbaed74cf94b827b79.zip
genirq: Prevent use-after-free and work list corruption
[ Upstream commit 59c39840f5abf4a71e1810a8da71aaccd6c17d26 ] When irq_set_affinity_notifier() replaces the notifier, then the reference count on the old notifier is dropped which causes it to be freed. But nothing ensures that the old notifier is not longer queued in the work list. If it is queued this results in a use after free and possibly in work list corruption. Ensure that the work is canceled before the reference is dropped. Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: marc.zyngier@arm.com Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeaurora.org Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/irq/manage.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 83cea913983c..92c7eb1aeded 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -319,8 +319,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
desc->affinity_notify = notify;
raw_spin_unlock_irqrestore(&desc->lock, flags);
- if (old_notify)
+ if (old_notify) {
+ cancel_work_sync(&old_notify->work);
kref_put(&old_notify->kref, old_notify->release);
+ }
return 0;
}