[PATCH v4 06/15] media: sunxi-cir: Ensure no more interrupts can occur before free

[PATCH v4 06/15] media: sunxi-cir: Ensure no more interrupts can occur before free

[Sean Young]

Only call rc_free_device() once the hardware has been stopped.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Signed-off-by: Sean Young <sean@mess.org>
Cc: stable@vger.kernel.org
---
 drivers/media/rc/sunxi-cir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
index 28e840a7e5b8..af1ee08ffdbe 100644
--- a/drivers/media/rc/sunxi-cir.c
+++ b/drivers/media/rc/sunxi-cir.c
@@ -374,8 +374,8 @@ static void sunxi_ir_remove(struct platform_device *pdev)
 	struct sunxi_ir *ir = platform_get_drvdata(pdev);
 
 	rc_unregister_device(ir->rc);
-	rc_free_device(ir->rc);
 	sunxi_ir_hw_exit(&pdev->dev);
+	rc_free_device(ir->rc);
 }
 
 static void sunxi_ir_shutdown(struct platform_device *pdev)
-- 
2.55.0

Re: [PATCH v4 06/15] media: sunxi-cir: Ensure no more interrupts can occur before free

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch attempts to fix a use-after-free by delaying `rc_free_device()` until after `sunxi_ir_hw_exit()`. However, `sunxi_ir_hw_exit()` only disables the hardware clocks and asserts reset; it does not mask the devm-managed IRQ or wait for in-flight interrupt handlers to complete via `synchronize_irq()`. This leaves the driver vulnerable to two fatal issues: 1) If an IRQ handler is executing concurrently, disabling the APB clock while it accesses memory-mapped registers will cause a synchronous external abort (bus hang). 2) If the handler continues executing after `sunxi_ir_hw_exit()` returns, it will access `ir->rc` while it is being freed by `rc_free_device()`, resulting in a use-after-free.
- [High] The IRQ is requested via `devm_request_irq()` before the hardware clocks are initialized by `sunxi_ir_hw_init()`, risking a synchronous external abort (bus hang) on spurious or pending interrupts during probe.
- [High] The devm-managed IRQ handler can execute and access a freed RC device if `sunxi_ir_hw_init()` fails in `sunxi_ir_probe()`.
--

--- Patch [6]: [PATCH v4 06/15] media: sunxi-cir: Ensure no more interrupts can occur before free ---
commit 6e49e6c93b7dee54eb10aca37f27b9448afeb67a
Author: Sean Young <sean@mess.org>

media: sunxi-cir: Ensure no more interrupts can occur before free

Only call rc_free_device() once the hardware has been stopped.

Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
Cc: stable@vger.kernel.org

> diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
> index 28e840a7e5b8c..af1ee08ffdbec 100644
> --- a/drivers/media/rc/sunxi-cir.c
> +++ b/drivers/media/rc/sunxi-cir.c
> @@ -374,8 +374,8 @@ static void sunxi_ir_remove(struct platform_device *pdev)
>  	struct sunxi_ir *ir = platform_get_drvdata(pdev);
>  
>  	rc_unregister_device(ir->rc);
> -	rc_free_device(ir->rc);
>  	sunxi_ir_hw_exit(&pdev->dev);
> +	rc_free_device(ir->rc);

[Severity: High]
This is a pre-existing issue, but does sunxi_ir_hw_exit() adequately prevent
further interrupts from executing?

sunxi_ir_hw_exit() disables clocks and asserts reset, but it doesn't appear
to mask the devm-managed IRQ or wait for in-flight handlers to finish via
synchronize_irq().

If an interrupt fires concurrently or an IRQ handler is already running:

drivers/media/rc/sunxi-cir.c:sunxi_ir_irq() {
    ...
    status = readl(ir->base + SUNXI_IR_RXSTA_REG);
    ...
}

Could disabling the APB clock while this handler is accessing memory-mapped
registers cause a synchronous external abort? Furthermore, if the handler
continues executing after sunxi_ir_hw_exit() returns, could it access the
freed ir->rc device pointer?

>  }

Looking at the probe function in the same file:

drivers/media/rc/sunxi-cir.c:sunxi_ir_probe() {
    ...
    ret = devm_request_irq(dev, ir->irq, sunxi_ir_irq, 0, SUNXI_IR_DEV, ir);
    if (ret) {
        dev_err(dev, "failed request irq\n");
        goto exit_unregister_dev;
    }

    ret = sunxi_ir_hw_init(dev);
    if (ret)
        goto exit_unregister_dev;
    ...
exit_unregister_dev:
    rc_unregister_device(ir->rc);

exit_free_dev:
    rc_free_device(ir->rc);
}

[Severity: High]
This is a pre-existing issue, but is it safe to request the IRQ before the
hardware clocks are initialized?

If a pending interrupt from the bootloader or a spurious IRQ triggers
sunxi_ir_irq() before sunxi_ir_hw_init() enables the clock, could this lead
to a synchronous external abort when the handler reads ir->base?

[Severity: High]
This is another pre-existing issue, but does the error path for a failed
sunxi_ir_hw_init() leave the devm-managed IRQ active until the probe function
returns?

If an interrupt fires during this window, could the handler dereference
ir->rc after it has been freed by rc_free_device() at the exit_free_dev
label?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785158244.git.sean@mess.org?part=6