Patchwork sparc32,leon: Check for existent irq_map entry in leon_handle_ext_irq

login
register
mail settings
Submitter Andreas Larsson
Date Oct. 30, 2012, 10:09 a.m.
Message ID <1351591786-21024-1-git-send-email-andreas@gaisler.com>
Download mbox | patch
Permalink /patch/195384/
State Accepted
Delegated to: David Miller
Headers show

Comments

Andreas Larsson - Oct. 30, 2012, 10:09 a.m.
If an irq is being unlinked concurrently with leon_handle_ext_irq,
irq_map[eirq] might be null in leon_handle_ext_irq. Make sure that
this is not dereferenced.

Signed-off-by: Andreas Larsson <andreas@gaisler.com>
---
 arch/sparc/kernel/leon_kernel.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)
Sam Ravnborg - Nov. 4, 2012, 1:53 p.m.
On Tue, Oct 30, 2012 at 11:09:46AM +0100, Andreas Larsson wrote:
> If an irq is being unlinked concurrently with leon_handle_ext_irq,
> irq_map[eirq] might be null in leon_handle_ext_irq. Make sure that
> this is not dereferenced.
> 
> Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>

	Sam
--
To unsubscribe from this list: send the line "unsubscribe sparclinux" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - Nov. 10, 2012, 3:48 a.m.
From: Andreas Larsson <andreas@gaisler.com>
Date: Tue, 30 Oct 2012 11:09:46 +0100

> If an irq is being unlinked concurrently with leon_handle_ext_irq,
> irq_map[eirq] might be null in leon_handle_ext_irq. Make sure that
> this is not dereferenced.
> 
> Signed-off-by: Andreas Larsson <andreas@gaisler.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe sparclinux" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/arch/sparc/kernel/leon_kernel.c b/arch/sparc/kernel/leon_kernel.c
index f8b6eee..87f60ee 100644
--- a/arch/sparc/kernel/leon_kernel.c
+++ b/arch/sparc/kernel/leon_kernel.c
@@ -56,11 +56,13 @@  static inline unsigned int leon_eirq_get(int cpu)
 static void leon_handle_ext_irq(unsigned int irq, struct irq_desc *desc)
 {
 	unsigned int eirq;
+	struct irq_bucket *p;
 	int cpu = sparc_leon3_cpuid();
 
 	eirq = leon_eirq_get(cpu);
-	if ((eirq & 0x10) && irq_map[eirq]->irq) /* bit4 tells if IRQ happened */
-		generic_handle_irq(irq_map[eirq]->irq);
+	p = irq_map[eirq];
+	if ((eirq & 0x10) && p && p->irq) /* bit4 tells if IRQ happened */
+		generic_handle_irq(p->irq);
 }
 
 /* The extended IRQ controller has been found, this function registers it */