linux-kernel - Re: [PATCH] rc: img-ir: fix error in parameters passed to irq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 10 Feb 2015 12:04:10 +0000
From:	James Hogan <james.hogan@...tec.com>
To:	Sifan Naeem <sifan.naeem@...tec.com>
CC:	<mchehab@....samsung.com>, <linux-kernel@...r.kernel.org>,
	<linux-media@...r.kernel.org>
Subject: Re: [PATCH] rc: img-ir: fix error in parameters passed to irq_free()

On Tue, Feb 10, 2015 at 10:41:56AM +0000, Sifan Naeem wrote:
> img_ir_remove() passes a pointer to the ISR function as the 2nd
> parameter to irq_free() instead of a pointer to the device data
> structure.
> This issue causes unloading img-ir module to fail with the below
> warning after building and loading img-ir as a module.
> 
> WARNING: CPU: 2 PID: 155 at ../kernel/irq/manage.c:1278
> __free_irq+0xb4/0x214() Trying to free already-free IRQ 58
> Modules linked in: img_ir(-)
> CPU: 2 PID: 155 Comm: rmmod Not tainted 3.14.0 #55 ...
> Call Trace:
> ...
> [<8048d420>] __free_irq+0xb4/0x214
> [<8048d6b4>] free_irq+0xac/0xf4
> [<c009b130>] img_ir_remove+0x54/0xd4 [img_ir] [<8073ded0>]
> platform_drv_remove+0x30/0x54 ...
> 
> Signed-off-by: Sifan Naeem <sifan.naeem@...tec.com>
> Fixes: 160a8f8aec4d ("[media] rc: img-ir: add base driver")
> Cc: <stable@...r.kernel.org> # 3.15+

Thanks for catching this Sifan. It appears to have been introduced while
getting the driver ready for upstream (it used to use the devm_* API to
request the IRQ, but I changed it to avoid the ISR racing with module
removal).

Acked-by: James Hogan <james.hogan@...tec.com>

Cheers
James

> ---
>  drivers/media/rc/img-ir/img-ir-core.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/rc/img-ir/img-ir-core.c b/drivers/media/rc/img-ir/img-ir-core.c
> index 77c78de..7020659 100644
> --- a/drivers/media/rc/img-ir/img-ir-core.c
> +++ b/drivers/media/rc/img-ir/img-ir-core.c
> @@ -146,7 +146,7 @@ static int img_ir_remove(struct platform_device *pdev)
>  {
>  	struct img_ir_priv *priv = platform_get_drvdata(pdev);
>  
> -	free_irq(priv->irq, img_ir_isr);
> +	free_irq(priv->irq, priv);
>  	img_ir_remove_hw(priv);
>  	img_ir_remove_raw(priv);
>  
> -- 
> 1.7.9.5
> 

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)