From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.9 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,T_DKIMWL_WL_HIGH,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70716C04AB2 for ; Thu, 9 May 2019 18:46:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 44CD82183E for ; Thu, 9 May 2019 18:46:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557427591; bh=y/uQpF+sT1hS2ewMcrT/AYs4ZxyJipvwZvjTwsz/pfs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IC3fk0jPbi7SMyJ3ZIzyFNN5UdVdHQG0z2ZW4RCMgoKN0q5m0HAfIoBo+E/bbpoao 8MySyC5gFE/Qb9KWJf/3kxneH4a1+PK1g3YkEVZVHCfOc/0KlTf7OlQpdp31ToGV9V OOANpvd2q3SWHzsVmdW1+TkUmVX9mBcm4h7eiOGc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727606AbfEISqa (ORCPT ); Thu, 9 May 2019 14:46:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:38816 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727595AbfEISq2 (ORCPT ); Thu, 9 May 2019 14:46:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DA6BA21848; Thu, 9 May 2019 18:46:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1557427587; bh=y/uQpF+sT1hS2ewMcrT/AYs4ZxyJipvwZvjTwsz/pfs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pr5U1bWU/9sAtUmUS3v1JQy3+c6mb042uiP4PGwmgH3Dy2IJ2Vt5iILxW3qs/soyA lymQPf4VL3NJ9uo0hsRJ1zQo3A8Z6Z/tGz7xsgH4D69hN1KmqADLa2gyh768+F+MUY gf3B+y0ZI8/28D+xfapfVa81bOT1S0RPekbvXqGE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Prasad Sodagudi , Thomas Gleixner , marc.zyngier@arm.com, Sasha Levin Subject: [PATCH 4.14 30/42] genirq: Prevent use-after-free and work list corruption Date: Thu, 9 May 2019 20:42:19 +0200 Message-Id: <20190509181258.720007945@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190509181252.616018683@linuxfoundation.org> References: <20190509181252.616018683@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit 59c39840f5abf4a71e1810a8da71aaccd6c17d26 ] When irq_set_affinity_notifier() replaces the notifier, then the reference count on the old notifier is dropped which causes it to be freed. But nothing ensures that the old notifier is not longer queued in the work list. If it is queued this results in a use after free and possibly in work list corruption. Ensure that the work is canceled before the reference is dropped. Signed-off-by: Prasad Sodagudi Signed-off-by: Thomas Gleixner Cc: marc.zyngier@arm.com Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeaurora.org Signed-off-by: Sasha Levin --- kernel/irq/manage.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c index 6c877d28838f2..9c86a3e451101 100644 --- a/kernel/irq/manage.c +++ b/kernel/irq/manage.c @@ -323,8 +323,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify) desc->affinity_notify = notify; raw_spin_unlock_irqrestore(&desc->lock, flags); - if (old_notify) + if (old_notify) { + cancel_work_sync(&old_notify->work); kref_put(&old_notify->kref, old_notify->release); + } return 0; } -- 2.20.1