From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38DB9C0015E for ; Tue, 25 Jul 2023 11:46:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232058AbjGYLqc (ORCPT ); Tue, 25 Jul 2023 07:46:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53998 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232381AbjGYLq0 (ORCPT ); Tue, 25 Jul 2023 07:46:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A6F32199D for ; Tue, 25 Jul 2023 04:46:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 31CA8616A3 for ; Tue, 25 Jul 2023 11:46:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C633C433C9; Tue, 25 Jul 2023 11:46:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1690285584; bh=LG2Q3rTLv+lKquUEhX9OxuIyBz9mfouwenPbPX0v58E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ilIa1GpOHsKOK9qHOVGCHxPcGgXilhaVLglbhpM0eRr4HDM9uBP6bC7y523D/UT0I xzIPXinixOdsdMSAyjiHrO0y+wuBWmPfCjwz0xUVRSDygPqVc85TzbKk9ntipkzIxp GuDgmN00Gcceq1Ar6CGhUPo4ew5FVUDJs+wKuoGg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Damien Le Moal , Lorenzo Pieralisi , Bjorn Helgaas , Manivannan Sadhasivam Subject: [PATCH 5.4 250/313] misc: pci_endpoint_test: Free IRQs before removing the device Date: Tue, 25 Jul 2023 12:46:43 +0200 Message-ID: <20230725104531.876698112@linuxfoundation.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230725104521.167250627@linuxfoundation.org> References: <20230725104521.167250627@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Damien Le Moal commit f61b7634a3249d12b9daa36ffbdb9965b6f24c6c upstream. In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released, causing the IRQ handler to access invalid memory, resulting in an oops. Free the device IRQs before removing the device to avoid this issue. Link: https://lore.kernel.org/r/20230415023542.77601-15-dlemoal@kernel.org Fixes: e03327122e2c ("pci_endpoint_test: Add 2 ioctl commands") Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/misc/pci_endpoint_test.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/misc/pci_endpoint_test.c +++ b/drivers/misc/pci_endpoint_test.c @@ -774,6 +774,9 @@ static void pci_endpoint_test_remove(str if (id < 0) return; + pci_endpoint_test_release_irq(test); + pci_endpoint_test_free_irq_vectors(test); + misc_deregister(&test->miscdev); kfree(misc_device->name); ida_simple_remove(&pci_endpoint_test_ida, id); @@ -782,9 +785,6 @@ static void pci_endpoint_test_remove(str pci_iounmap(pdev, test->bar[bar]); } - pci_endpoint_test_release_irq(test); - pci_endpoint_test_free_irq_vectors(test); - pci_release_regions(pdev); pci_disable_device(pdev); }