Re: [PATCH v5 06/15] media: sunxi-cir: Ensure no more interrupts can occur before free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The teardown race between `sunxi_ir_remove()` and `sunxi_ir_irq()` is not resolved by the patch. The interrupt remains active and unsynchronized while clocks are disabled and memory is freed, leading to synchronous external aborts and use-after-free vulnerabilities. A similar issue exists in `probe()` where the IRQ is requested before clocks are enabled.
--

--- Patch [6]: [PATCH v5 06/15] media: sunxi-cir: Ensure no more interrupts can occur before free ---
commit 485344025b667511dbe1afe16a5fb9cab1f312f6
Author: Sean Young <sean@mess.org>

media: sunxi-cir: Ensure no more interrupts can occur before free

This commit delays rc_free_device() until after sunxi_ir_hw_exit() in the
remove path. It attempts to ensure the hardware is stopped and no further
interrupts can occur before the device memory is freed.

Cc: stable@vger.kernel.org

> diff --git a/drivers/media/rc/sunxi-cir.c b/drivers/media/rc/sunxi-cir.c
> index 28e840a7e5b8c..af1ee08ffdbec 100644
> --- a/drivers/media/rc/sunxi-cir.c
> +++ b/drivers/media/rc/sunxi-cir.c
> @@ -374,8 +374,8 @@ static void sunxi_ir_remove(struct platform_device *pdev)
>  	struct sunxi_ir *ir = platform_get_drvdata(pdev);
>  
>  	rc_unregister_device(ir->rc);
> -	rc_free_device(ir->rc);
>  	sunxi_ir_hw_exit(&pdev->dev);
> +	rc_free_device(ir->rc);

[Severity: High]
This is a pre-existing issue, but does this actually prevent interrupts from
occurring before the free?

The driver requests the IRQ via devm_request_irq() in sunxi_ir_probe(), which
means the IRQ is not freed or synchronized until devres cleanup runs after
sunxi_ir_remove() returns.

While sunxi_ir_hw_exit() disables the APB clock, it does not explicitly disable
or synchronize the IRQ handler. If an interrupt executes concurrently, can it
fault when reading unclocked MMIO registers?

drivers/media/rc/sunxi-cir.c:sunxi_ir_irq() {
	...
	status = readl(ir->base + SUNXI_IR_RXSTA_REG);
	...
	ir_raw_event_store_with_filter(ir->rc, &rawir);
}

Because the IRQ handler is unsynchronized, could it also dereference the freed
ir->rc if it races with or runs after rc_free_device()?

Additionally, is there a similar window in sunxi_ir_probe()?

drivers/media/rc/sunxi-cir.c:sunxi_ir_probe() {
	...
	ret = devm_request_irq(dev, ir->irq, sunxi_ir_irq, 0, SUNXI_IR_DEV, ir);
	...
	ret = sunxi_ir_hw_init(dev);
	...
}

The IRQ handler is requested and enabled before sunxi_ir_hw_init() enables
the APB clock. Could a pending interrupt trigger the handler and access
unclocked registers during boot?

>  }
>  
>  static void sunxi_ir_shutdown(struct platform_device *pdev)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785338381.git.sean@mess.org?part=6