linux-kernel - [PATCH 1/2] uio: Request/free irq separate from dev lifecycle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <550B0D8E.1010200@brocade.com>
Date:	Thu, 19 Mar 2015 17:55:26 +0000
From:	Brian Russell <brian.russell@...cade.com>
To:	"Hans J. Koch" <hjk@...sjkoch.de>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:	<linux-kernel@...r.kernel.org>
Subject: [PATCH 1/2] uio: Request/free irq separate from dev lifecycle

Separate irq request/free from the device lifecycle.
After device unregister the parent module can call pci_disable_msi.
>From the PCI MSI how to:

"Before calling this function, a device driver must always call free_irq()
on any interrupt for which it previously called request_irq().
Failure to do so results in a BUG_ON(), leaving the device with
MSI enabled and thus leaking its vector."

So we need to separately free the irq at unregister to allow the device
to be kept around in the case of it still having open FDs.

Signed-off-by: Brian Russell <brussell@...cade.com>
---
 drivers/uio/uio.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 6276f13..65bf067 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -835,7 +835,15 @@ int __uio_register_device(struct module *owner,
 	info->uio_dev = idev;

 	if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
-		ret = devm_request_irq(idev->dev, info->irq, uio_interrupt,
+		/*
+		 * Note that we deliberately don't use devm_request_irq
+		 * here. The parent module can unregister the UIO device
+		 * and call pci_disable_msi, which requires that this
+		 * irq has been freed. However, the device may have open
+		 * FDs at the time of unregister and therefore may not be
+		 * freed until they are released.
+		 */
+		ret = request_irq(info->irq, uio_interrupt,
 				  info->irq_flags, info->name, idev);
 		if (ret)
 			goto err_request_irq;
@@ -871,6 +879,8 @@ void uio_unregister_device(struct uio_info *info)

 	uio_dev_del_attributes(idev);

+	free_irq(idev->info->irq, idev);
+
 	device_destroy(&uio_class, MKDEV(uio_major, idev->minor));

 	return;
-- 
2.1.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/