From: Rosen Penev <rosenp@gmail.com>
To: linux-edac@vger.kernel.org
Cc: Frank Li <Frank.Li@nxp.com>, Borislav Petkov <bp@alien8.de>,
Tony Luck <tony.luck@intel.com>,
Nathan Chancellor <nathan@kernel.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Bill Wendling <morbo@google.com>,
Justin Stitt <justinstitt@google.com>,
York Sun <york.sun@nxp.com>,
imx@lists.linux.dev (open list:EDAC-FSL_DDR),
linux-kernel@vger.kernel.org (open list),
llvm@lists.linux.dev (open list:CLANG/LLVM BUILD
SUPPORT:Keyword:\b(?i:clang|llvm)\b)
Subject: [PATCH 0/2] EDAC: fsl_ddr: probe failure and remove lifetime fixes
Date: Sun, 19 Jul 2026 12:40:07 -0700 [thread overview]
Message-ID: <20260719194009.117532-1-rosenp@gmail.com> (raw)
This series fixes two lifetime/error-path issues in the FSL DDR EDAC
driver (drivers/edac/fsl_ddr_edac.c):
* Patch 1: On probe failure, fsl_mc_err_probe() leaves the memory
controller hardware configured to generate interrupts (DISABLE cleared,
INT_EN set) while no handler is registered, which can trigger an
unhandled interrupt storm on the shared IRQ line. Restore the MC error
registers in both error paths.
* Patch 2: The devm-requested IRQ passes mci as context, but
fsl_mc_err_remove() frees mci via edac_mc_free() before devres tears
down the IRQ, leaving a use-after-free window for the shared interrupt
handler. Manage mci lifetime through devres so it is freed only after
the IRQ is released.
Both patches are build-tested for arm64 (defconfig + CONFIG_EDAC_FSL_DDR)
with LLVM=1.
Rosen Penev (2):
EDAC: fsl_ddr: restore MC error registers on probe failure
EDAC: fsl_ddr: manage mci lifetime via devres to fix remove UAF
drivers/edac/fsl_ddr_edac.c | 42 +++++++++++++++++++++++--------------
1 file changed, 26 insertions(+), 16 deletions(-)
--
2.55.0
next reply other threads:[~2026-07-19 19:40 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-19 19:40 Rosen Penev [this message]
2026-07-19 19:40 ` [PATCH 1/2] EDAC: fsl_ddr: restore MC error registers on probe failure Rosen Penev
2026-07-19 19:51 ` sashiko-bot
2026-07-19 19:40 ` [PATCH 2/2] EDAC: fsl_ddr: manage mci lifetime via devres to fix remove UAF Rosen Penev
2026-07-19 19:51 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260719194009.117532-1-rosenp@gmail.com \
--to=rosenp@gmail.com \
--cc=Frank.Li@nxp.com \
--cc=bp@alien8.de \
--cc=imx@lists.linux.dev \
--cc=justinstitt@google.com \
--cc=linux-edac@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=morbo@google.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=tony.luck@intel.com \
--cc=york.sun@nxp.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox