diff mbox series

[08/12] misc: pci_endpoint_test: Free IRQs before removing the device

Message ID 20230215032155.74993-9-damien.lemoal@opensource.wdc.com (mailing list archive)
State Superseded
Headers show
Series PCI endpoint fixes and improvements | expand

Commit Message

Damien Le Moal Feb. 15, 2023, 3:21 a.m. UTC
In pci_endpoint_test_remove(), freeing the IRQs after removing the
device creates a small race window for IRQs to be received with the test
device memory already released, causing the IRQ handler to access
invalid memory, resulting in an oops.

Free the device IRQs before removing the device to avoid this issue.

Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
---
 drivers/misc/pci_endpoint_test.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Manivannan Sadhasivam Feb. 16, 2023, 10:46 a.m. UTC | #1
On Wed, Feb 15, 2023 at 12:21:51PM +0900, Damien Le Moal wrote:
> In pci_endpoint_test_remove(), freeing the IRQs after removing the
> device creates a small race window for IRQs to be received with the test
> device memory already released, causing the IRQ handler to access
> invalid memory, resulting in an oops.
> 
> Free the device IRQs before removing the device to avoid this issue.
> 
> Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>

This looks like a bug. So there should be Fixes tag and stable list has to be
CCed for backporting.

With that,

Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>

Thanks,
Mani

> ---
>  drivers/misc/pci_endpoint_test.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
> index 11530b4ec389..e27d471cc847 100644
> --- a/drivers/misc/pci_endpoint_test.c
> +++ b/drivers/misc/pci_endpoint_test.c
> @@ -937,6 +937,9 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev)
>  	if (id < 0)
>  		return;
>  
> +	pci_endpoint_test_release_irq(test);
> +	pci_endpoint_test_free_irq_vectors(test);
> +
>  	misc_deregister(&test->miscdev);
>  	kfree(misc_device->name);
>  	kfree(test->name);
> @@ -946,9 +949,6 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev)
>  			pci_iounmap(pdev, test->bar[bar]);
>  	}
>  
> -	pci_endpoint_test_release_irq(test);
> -	pci_endpoint_test_free_irq_vectors(test);
> -
>  	pci_release_regions(pdev);
>  	pci_disable_device(pdev);
>  }
> -- 
> 2.39.1
>
diff mbox series

Patch

diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
index 11530b4ec389..e27d471cc847 100644
--- a/drivers/misc/pci_endpoint_test.c
+++ b/drivers/misc/pci_endpoint_test.c
@@ -937,6 +937,9 @@  static void pci_endpoint_test_remove(struct pci_dev *pdev)
 	if (id < 0)
 		return;
 
+	pci_endpoint_test_release_irq(test);
+	pci_endpoint_test_free_irq_vectors(test);
+
 	misc_deregister(&test->miscdev);
 	kfree(misc_device->name);
 	kfree(test->name);
@@ -946,9 +949,6 @@  static void pci_endpoint_test_remove(struct pci_dev *pdev)
 			pci_iounmap(pdev, test->bar[bar]);
 	}
 
-	pci_endpoint_test_release_irq(test);
-	pci_endpoint_test_free_irq_vectors(test);
-
 	pci_release_regions(pdev);
 	pci_disable_device(pdev);
 }