[PATCH] s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit()

[PATCH] s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit()

[Julian Ruess]

This patch prevents the system from crashing when unloading the ISM module.

How to reproduce: Attach an ISM device and execute 'rmmod ism'.

Error-Log:
- Trying to free already-free IRQ 0
- WARNING: CPU: 1 PID: 966 at kernel/irq/manage.c:1890 free_irq+0x140/0x540

After calling ism_dev_exit() for each ISM device in the exit routine,
pci_unregister_driver() will execute ism_remove() for each ISM device.
Because ism_remove() also calls ism_dev_exit(),
free_irq(pci_irq_vector(pdev, 0), ism) is called twice for each ISM
device. This results in a crash with the error
'Trying to free already-free IRQ'.

In the exit routine, it is enough to call pci_unregister_driver()
because it ensures that ism_dev_exit() is called once per
ISM device.

Cc: <stable@vger.kernel.org> # 6.3+
Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration")
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Julian Ruess <julianr@linux.ibm.com>
---
 drivers/s390/net/ism_drv.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c
index 8acb9eba691b..c2096e4bba31 100644
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -771,14 +771,6 @@ static int __init ism_init(void)
 
 static void __exit ism_exit(void)
 {
-	struct ism_dev *ism;
-
-	mutex_lock(&ism_dev_list.mutex);
-	list_for_each_entry(ism, &ism_dev_list.list, list) {
-		ism_dev_exit(ism);
-	}
-	mutex_unlock(&ism_dev_list.mutex);
-
 	pci_unregister_driver(&ism_driver);
 	debug_unregister(ism_debug_info);
 }

---
base-commit: 858fd168a95c5b9669aac8db6c14a9aeab446375
change-id: 20230613-ism-rmmod-crash-d4f34223a683

Best regards,
-- 
Julian Ruess <julianr@linux.ibm.com>

Re: [PATCH] s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Tue, 13 Jun 2023 14:25:37 +0200 you wrote:
> This patch prevents the system from crashing when unloading the ISM module.
> 
> How to reproduce: Attach an ISM device and execute 'rmmod ism'.
> 
> Error-Log:
> - Trying to free already-free IRQ 0
> - WARNING: CPU: 1 PID: 966 at kernel/irq/manage.c:1890 free_irq+0x140/0x540
> 
> [...]

Here is the summary with links:
  - s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit()
    https://git.kernel.org/netdev/net/c/78d0f94902af

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html