queue-4.4/genirq-prevent-use-after-free-and-work-list-corrupti.patch

   1 From b51a257b5c3c7634ef27e881e9ad80e5407c0dc0 Mon Sep 17 00:00:00 2001
   2 From: Prasad Sodagudi <psodagud@codeaurora.org>
   3 Date: Sun, 24 Mar 2019 07:57:04 -0700
   4 Subject: genirq: Prevent use-after-free and work list corruption
   5
   6 [ Upstream commit 59c39840f5abf4a71e1810a8da71aaccd6c17d26 ]
   7
   8 When irq_set_affinity_notifier() replaces the notifier, then the
   9 reference count on the old notifier is dropped which causes it to be
  10 freed. But nothing ensures that the old notifier is not longer queued
  11 in the work list. If it is queued this results in a use after free and
  12 possibly in work list corruption.
  13
  14 Ensure that the work is canceled before the reference is dropped.
  15
  16 Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
  17 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  18 Cc: marc.zyngier@arm.com
  19 Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeaurora.org
  20 Signed-off-by: Sasha Levin <sashal@kernel.org>
  21 ---
  22  kernel/irq/manage.c | 4 +++-
  23  1 file changed, 3 insertions(+), 1 deletion(-)
  24
  25 diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
  26 index 83cea913983c5..92c7eb1aeded9 100644
  27 --- a/kernel/irq/manage.c
  28 +++ b/kernel/irq/manage.c
  29 @@ -319,8 +319,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
  30         desc->affinity_notify = notify;
  31         raw_spin_unlock_irqrestore(&desc->lock, flags);
  32
  33 -       if (old_notify)
  34 +       if (old_notify) {
  35 +               cancel_work_sync(&old_notify->work);
  36                 kref_put(&old_notify->kref, old_notify->release);
  37 +       }
  38
  39         return 0;
  40  }
  41 --
  42 2.20.1
  43