Thomas Gleixner 827685a637 genirq: Validate action before dereferencing it in handle_irq_event_percpu() ... commit 570540d50710ed192e98e2f7f74578c9486b6b05 upstream. commit 71f64340fc changed the handling of irq_desc->action from CPU 0 CPU 1 free_irq() lock(desc) lock(desc) handle_edge_irq() if (desc->action) { handle_irq_event() action = desc->action unlock(desc) desc->action = NULL handle_irq_event_percpu(desc, action) action->xxx to CPU 0 CPU 1 free_irq() lock(desc) lock(desc) handle_edge_irq() if (desc->action) { handle_irq_event() unlock(desc) desc->action = NULL handle_irq_event_percpu(desc, action) action = desc->action action->xxx So if free_irq manages to set the action to NULL between the unlock and before the readout, we happily dereference a null pointer. We could simply revert 71f64340fc, but we want to preserve the better code generation. A simple solution is to change the action loop from a do {} while to a while {} loop. This is safe because we either see a valid desc->action or NULL. If the action is about to be removed it is still valid as free_irq() is blocked on synchronize_irq(). CPU 0 CPU 1 free_irq() lock(desc) lock(desc) handle_edge_irq() handle_irq_event(desc) set(INPROGRESS) unlock(desc) handle_irq_event_percpu(desc) action = desc->action desc->action = NULL while (action) { action->xxx ... action = action->next; sychronize_irq() while(INPROGRESS); lock(desc) clr(INPROGRESS) free(action) That's basically the same mechanism as we have for shared interrupts. action->next can become NULL while handle_irq_event_percpu() runs. Either it sees the action or NULL. It does not matter, because action itself cannot go away before the interrupt in progress flag has been cleared. Fixes: commit 71f64340fc "genirq: Remove the second parameter from handle_irq_event_percpu()" Reported-by: zyjzyj2000@gmail.com Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Huang Shijie <shijie.huang@arm.com> Cc: Jiang Liu <jiang.liu@linux.intel.com> Cc: Peter Zijlstra <peterz@infradead.org> Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1601131224190.3575@nanos Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-03-03 15:07:11 -08:00
..
autoprobe.c
chip.c	genirq: Add flag to force mask in disable_irq[_nosync]()	2015-10-11 11:33:42 +02:00
cpuhotplug.c	genirq: Make the cpuhotplug migration code less noisy	2015-10-22 14:34:57 +02:00
debug.h
devres.c
dummychip.c
generic-chip.c	genirq: Add chip_[suspend|resume] PM support to irq_chip	2015-07-27 08:09:38 +02:00
handle.c	genirq: Validate action before dereferencing it in handle_irq_event_percpu()	2016-03-03 15:07:11 -08:00
internals.h	genirq/PM: Restore system wake up from chained interrupts	2015-11-10 09:11:31 -05:00
irqdesc.c	genirq: Remove irq argument from irq flow handlers	2015-09-16 15:47:51 +02:00
irqdomain.c	irqdomain: Introduce irq_domain_create_hierarchy	2015-10-13 19:01:25 +02:00
Kconfig	genirq: Introduce generic irq migration for cpu hotunplug	2015-10-01 14:51:15 +02:00
Makefile	genirq: Introduce generic irq migration for cpu hotunplug	2015-10-01 14:51:15 +02:00
manage.c	genirq: Prevent chip buslock deadlock	2015-12-14 09:45:06 +01:00
migration.c
msi.c	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-11-03 14:40:01 -08:00
pm.c	Merge branches 'irq-urgent-for-linus' and 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-11-15 09:30:48 -08:00
proc.c	genirq/PM: Restore system wake up from chained interrupts	2015-11-10 09:11:31 -05:00
resend.c	genirq: Remove irq argument from irq flow handlers	2015-09-16 15:47:51 +02:00
settings.h	genirq: Add flag to force mask in disable_irq[_nosync]()	2015-10-11 11:33:42 +02:00
spurious.c	genirq: Remove the irq argument from note_interrupt()	2015-07-11 23:14:25 +02:00