linux-kernel - [tip:irq/urgent] genirq: Properly pair kobject_del() with kobject

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <tip-e1ee29624746fbf667f80e8ae3815a76e4d1bd5b@git.kernel.org>
Date:   Mon, 19 Aug 2019 07:01:06 -0700
From:   tip-bot for Michael Kelley <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, mikelley@...rosoft.com,
        gregkh@...uxfoundation.org, hpa@...or.com, mingo@...nel.org,
        tglx@...utronix.de
Subject: [tip:irq/urgent] genirq: Properly pair kobject_del() with
 kobject_add()

Commit-ID:  e1ee29624746fbf667f80e8ae3815a76e4d1bd5b
Gitweb:     https://git.kernel.org/tip/e1ee29624746fbf667f80e8ae3815a76e4d1bd5b
Author:     Michael Kelley <mikelley@...rosoft.com>
AuthorDate: Thu, 1 Aug 2019 23:53:53 +0000
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Mon, 19 Aug 2019 15:56:28 +0200

genirq: Properly pair kobject_del() with kobject_add()

If alloc_descs() fails before irq_sysfs_init() has run, free_desc() in the
cleanup path will call kobject_del() even though the kobject has not been
added with kobject_add().

Fix this by making the call to kobject_del() conditional on whether
irq_sysfs_init() has run.

This problem surfaced because commit aa30f47cf666 ("kobject: Add support
for default attribute groups to kobj_type") makes kobject_del() stricter
about pairing with kobject_add(). If the pairing is incorrrect, a WARNING
and backtrace occur in sysfs_remove_group() because there is no parent.

[ tglx: Add a comment to the code ]

Fixes: ecb3f394c5db ("genirq: Expose interrupt information through sysfs")
Signed-off-by: Michael Kelley <mikelley@...rosoft.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Acked-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: stable@...r.kernel.org
Link: https://lkml.kernel.org/r/1564703564-4116-1-git-send-email-mikelley@microsoft.com

---
 kernel/irq/irqdesc.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 9484e88dabc2..51f42f3caf09 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -437,8 +437,14 @@ static void free_desc(unsigned int irq)
 	 *
 	 * The sysfs entry must be serialized against a concurrent
 	 * irq_sysfs_init() as well.
+	 *
+	 * If irq_sysfs_init() has not yet been invoked (early boot), then
+	 * irq_kobj_base is NULL and the descriptor was never added.
+	 * kobject_del() complains about a object with no parent, so make
+	 * it conditional.
 	 */
-	kobject_del(&desc->kobj);
+	if (irq_kobj_base)
+		kobject_del(&desc->kobj);
 	delete_irq_desc(irq);
 
 	/*