linux-kernel - [PATCH v2 4/6] scsi: ufs: prevent IRQ handler accessing already freed hostdata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun,  2 Aug 2015 02:19:18 +0900
From:	Akinobu Mita <akinobu.mita@...il.com>
To:	linux-scsi@...r.kernel.org
Cc:	Akinobu Mita <akinobu.mita@...il.com>,
	Vinayak Holikatti <vinholikatti@...il.com>,
	"James E.J. Bottomley" <JBottomley@...n.com>,
	Christoph Hellwig <hch@....de>,
	Dolev Raviv <draviv@...eaurora.org>,
	Sujit Reddy Thumma <sthumma@...eaurora.org>,
	Subhash Jadavani <subhashj@...eaurora.org>,
	Hannes Reinecke <hare@...e.de>,
	Sahitya Tummala <stummala@...eaurora.org>,
	Yaniv Gardi <ygardi@...eaurora.org>,
	linux-kernel@...r.kernel.org
Subject: [PATCH v2 4/6] scsi: ufs: prevent IRQ handler accessing already freed hostdata

As UFS driver registers IRQ handler as a shared IRQ, when
CONFIG_DEBUG_SHIRQ=y, an extra call will be made while unregistering
the IRQ handler.  Unfortunately, the extra call will accesses already
freed hostdata.  This is because devm_request_irq() is used to register
IRQ handler so that it will be unregistered automatically on driver
remove, but the hostdata has already been freed at this time.

This fixes it by explicitly registering/unregistering IRQ handler on
driver probe/remove.

Signed-off-by: Akinobu Mita <akinobu.mita@...il.com>
Cc: Vinayak Holikatti <vinholikatti@...il.com>
Cc: "James E.J. Bottomley" <JBottomley@...n.com>
Cc: Christoph Hellwig <hch@....de>
Cc: Dolev Raviv <draviv@...eaurora.org>
Cc: Sujit Reddy Thumma <sthumma@...eaurora.org>
Cc: Subhash Jadavani <subhashj@...eaurora.org>
Cc: Hannes Reinecke <hare@...e.de>
Cc: Sahitya Tummala <stummala@...eaurora.org>
Cc: Yaniv Gardi <ygardi@...eaurora.org>
Cc: linux-scsi@...r.kernel.org
Cc: linux-kernel@...r.kernel.org
---
 drivers/scsi/ufs/ufshcd.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index e25f919..d425816 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -5361,6 +5361,7 @@ void ufshcd_remove(struct ufs_hba *hba)
 	scsi_remove_host(hba->host);
 	/* disable interrupts */
 	ufshcd_disable_intr(hba, hba->intr_mask);
+	ufshcd_disable_irq(hba);
 	ufshcd_hba_stop(hba);
 
 	ufshcd_exit_clk_gating(hba);
@@ -5611,13 +5612,9 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
 
 	ufshcd_init_clk_gating(hba);
 	/* IRQ registration */
-	err = devm_request_irq(dev, irq, ufshcd_intr, IRQF_SHARED, UFSHCD, hba);
-	if (err) {
-		dev_err(hba->dev, "request irq failed\n");
+	err = ufshcd_enable_irq(hba);
+	if (err)
 		goto exit_gating;
-	} else {
-		hba->is_irq_enabled = true;
-	}
 
 	/* Enable SCSI tag mapping */
 	err = scsi_init_shared_tag_map(host, host->can_queue);
@@ -5668,9 +5665,9 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
 out_remove_scsi_host:
 	scsi_remove_host(hba->host);
 exit_gating:
+	ufshcd_disable_irq(hba);
 	ufshcd_exit_clk_gating(hba);
 out_disable:
-	hba->is_irq_enabled = false;
 	ufshcd_hba_exit(hba);
 out_error:
 	scsi_host_put(host);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/