[PATCH] Bluetooth: btintel_pcie: fix double free of IRQ in remove()

[PATCH] Bluetooth: btintel_pcie: fix double free of IRQ in remove()

[Gongwei Li]

From: Gongwei Li <ligongwei@kylinos.cn>

The MSI-X IRQs are requested with devm_request_threaded_irq() in
btintel_pcie_setup_irq(), but btintel_pcie_remove() releases them
explicitly with free_irq() and then calls pci_free_irq_vectors().

After .remove() returns, the driver core releases the remaining devm
resources of the device, which calls free_irq() a second time on the
vectors that were already freed and whose MSI-X interrupt domain has
already been destroyed by pci_free_irq_vectors(), resulting in
splats like:

  Trying to free already-free IRQ <n>

Fix this by using devm_free_irq(), which unregisters the devres
entry and then frees the IRQ, keeping the free order introduced by
the commit below intact: the IRQs are still released before
pci_free_irq_vectors() and no double free happens on devm cleanup.

Fixes: 041677e7aad6 ("Bluetooth: btintel_pcie: Fix irq leak")
Cc: stable@vger.kernel.org
Signed-off-by: Gongwei Li <ligongwei@kylinos.cn>
---
 drivers/bluetooth/btintel_pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 2b7231be5973..8fc4b8e3e4e1 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2966,7 +2966,7 @@ static void btintel_pcie_remove(struct pci_dev *pdev)
 		struct msix_entry *msix_entry;
 
 		msix_entry = &data->msix_entries[i];
-		free_irq(msix_entry->vector, msix_entry);
+		devm_free_irq(&pdev->dev, msix_entry->vector, msix_entry);
 	}
 
 	pci_free_irq_vectors(pdev);
-- 
2.25.1

RE: Bluetooth: btintel_pcie: fix double free of IRQ in remove()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1145982

---Test result---

Test Summary:
CheckPatch                    PASS      0.75 seconds
VerifyFixes                   PASS      0.14 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      0.33 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      26.67 seconds
CheckAllWarning               PASS      29.85 seconds
CheckSparse                   PASS      28.36 seconds
BuildKernel32                 PASS      25.83 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      489.71 seconds
IncrementalBuild              PASS      24.33 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/582

---
Regards,
Linux Bluetooth