linux-kernel - RE: [PATCH 05/10] mei: vsc: Destroy mutex after freeing the IRQ

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CY5PR11MB6366ABBCC7A1CB3AB70098C9ED7BA@CY5PR11MB6366.namprd11.prod.outlook.com>
Date: Wed, 25 Jun 2025 08:03:31 +0000
From: "Usyskin, Alexander" <alexander.usyskin@...el.com>
To: Hans de Goede <hansg@...nel.org>, Sakari Ailus
	<sakari.ailus@...ux.intel.com>, Stanislaw Gruszka
	<stanislaw.gruszka@...ux.intel.com>
CC: Arnd Bergmann <arnd@...db.de>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: RE: [PATCH 05/10] mei: vsc: Destroy mutex after freeing the IRQ

> Subject: [PATCH 05/10] mei: vsc: Destroy mutex after freeing the IRQ
> 
> The event_notify callback which runs from vsc_tp_thread_isr may call
> vsc_tp_xfer() which locks the mutex. So the ISR depends on the mutex.
> 
> Move the mutex_destroy() call to after free_irq() to ensure that the ISR
> is not running while the mutex is destroyed.
> 

Reviewed-by: Alexander Usyskin <alexander.usyskin@...el.com>

> Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device")
> Signed-off-by: Hans de Goede <hansg@...nel.org>
> ---
>  drivers/misc/mei/vsc-tp.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/misc/mei/vsc-tp.c b/drivers/misc/mei/vsc-tp.c
> index f5438a600430..0feebffabdb3 100644
> --- a/drivers/misc/mei/vsc-tp.c
> +++ b/drivers/misc/mei/vsc-tp.c
> @@ -521,10 +521,10 @@ static int vsc_tp_probe(struct spi_device *spi)
>  	return 0;
> 
>  err_destroy_lock:
> -	mutex_destroy(&tp->mutex);
> -
>  	free_irq(spi->irq, tp);
> 
> +	mutex_destroy(&tp->mutex);
> +
>  	return ret;
>  }
> 
> @@ -535,9 +535,9 @@ static void vsc_tp_remove(struct spi_device *spi)
> 
>  	platform_device_unregister(tp->pdev);
> 
> -	mutex_destroy(&tp->mutex);
> -
>  	free_irq(spi->irq, tp);
> +
> +	mutex_destroy(&tp->mutex);
>  }
> 
>  static const struct acpi_device_id vsc_tp_acpi_ids[] = {
> --
> 2.49.0