| Submitter | Andreas Larsson |
|---|---|
| Date | Oct. 30, 2012, 10:09 a.m. |
| Message ID | <1351591786-21024-1-git-send-email-andreas@gaisler.com> |
| Download | mbox | patch |
| Permalink | /patch/195384/ |
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
Comments
On Tue, Oct 30, 2012 at 11:09:46AM +0100, Andreas Larsson wrote: > If an irq is being unlinked concurrently with leon_handle_ext_irq, > irq_map[eirq] might be null in leon_handle_ext_irq. Make sure that > this is not dereferenced. > > Signed-off-by: Andreas Larsson <andreas@gaisler.com> Acked-by: Sam Ravnborg <sam@ravnborg.org> Sam -- To unsubscribe from this list: send the line "unsubscribe sparclinux" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: Andreas Larsson <andreas@gaisler.com> Date: Tue, 30 Oct 2012 11:09:46 +0100 > If an irq is being unlinked concurrently with leon_handle_ext_irq, > irq_map[eirq] might be null in leon_handle_ext_irq. Make sure that > this is not dereferenced. > > Signed-off-by: Andreas Larsson <andreas@gaisler.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe sparclinux" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Patch
diff --git a/arch/sparc/kernel/leon_kernel.c b/arch/sparc/kernel/leon_kernel.c index f8b6eee..87f60ee 100644 --- a/arch/sparc/kernel/leon_kernel.c +++ b/arch/sparc/kernel/leon_kernel.c @@ -56,11 +56,13 @@ static inline unsigned int leon_eirq_get(int cpu) static void leon_handle_ext_irq(unsigned int irq, struct irq_desc *desc) { unsigned int eirq; + struct irq_bucket *p; int cpu = sparc_leon3_cpuid(); eirq = leon_eirq_get(cpu); - if ((eirq & 0x10) && irq_map[eirq]->irq) /* bit4 tells if IRQ happened */ - generic_handle_irq(irq_map[eirq]->irq); + p = irq_map[eirq]; + if ((eirq & 0x10) && p && p->irq) /* bit4 tells if IRQ happened */ + generic_handle_irq(p->irq); } /* The extended IRQ controller has been found, this function registers it */
If an irq is being unlinked concurrently with leon_handle_ext_irq, irq_map[eirq] might be null in leon_handle_ext_irq. Make sure that this is not dereferenced. Signed-off-by: Andreas Larsson <andreas@gaisler.com> --- arch/sparc/kernel/leon_kernel.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)