| Message ID | 20230215032155.74993-9-damien.lemoal@opensource.wdc.com |
|---|---|
| State | New |
| Headers | show |
| Series | PCI endpoint fixes and improvements | expand |
On Wed, Feb 15, 2023 at 12:21:51PM +0900, Damien Le Moal wrote: > In pci_endpoint_test_remove(), freeing the IRQs after removing the > device creates a small race window for IRQs to be received with the test > device memory already released, causing the IRQ handler to access > invalid memory, resulting in an oops. > > Free the device IRQs before removing the device to avoid this issue. > > Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> This looks like a bug. So there should be Fixes tag and stable list has to be CCed for backporting. With that, Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Thanks, Mani > --- > drivers/misc/pci_endpoint_test.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c > index 11530b4ec389..e27d471cc847 100644 > --- a/drivers/misc/pci_endpoint_test.c > +++ b/drivers/misc/pci_endpoint_test.c > @@ -937,6 +937,9 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev) > if (id < 0) > return; > > + pci_endpoint_test_release_irq(test); > + pci_endpoint_test_free_irq_vectors(test); > + > misc_deregister(&test->miscdev); > kfree(misc_device->name); > kfree(test->name); > @@ -946,9 +949,6 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev) > pci_iounmap(pdev, test->bar[bar]); > } > > - pci_endpoint_test_release_irq(test); > - pci_endpoint_test_free_irq_vectors(test); > - > pci_release_regions(pdev); > pci_disable_device(pdev); > } > -- > 2.39.1 >
diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c index 11530b4ec389..e27d471cc847 100644 --- a/drivers/misc/pci_endpoint_test.c +++ b/drivers/misc/pci_endpoint_test.c @@ -937,6 +937,9 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev) if (id < 0) return; + pci_endpoint_test_release_irq(test); + pci_endpoint_test_free_irq_vectors(test); + misc_deregister(&test->miscdev); kfree(misc_device->name); kfree(test->name); @@ -946,9 +949,6 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev) pci_iounmap(pdev, test->bar[bar]); } - pci_endpoint_test_release_irq(test); - pci_endpoint_test_free_irq_vectors(test); - pci_release_regions(pdev); pci_disable_device(pdev); }
In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released, causing the IRQ handler to access invalid memory, resulting in an oops. Free the device IRQs before removing the device to avoid this issue. Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com> --- drivers/misc/pci_endpoint_test.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)