releases/2.6.36.2/uml-disable-winch-irq-before-freeing-handler-data.patch

   1 From 69e83dad5207f8f03c9699e57e1febb114383cb8 Mon Sep 17 00:00:00 2001
   2 From: Will Newton <will.newton@gmail.com>
   3 Date: Wed, 24 Nov 2010 12:56:55 -0800
   4 Subject: uml: disable winch irq before freeing handler data
   5
   6 From: Will Newton <will.newton@gmail.com>
   7
   8 commit 69e83dad5207f8f03c9699e57e1febb114383cb8 upstream.
   9
  10 Disable the winch irq early to make sure we don't take an interrupt part
  11 way through the freeing of the handler data, resulting in a crash on
  12 shutdown:
  13
  14   winch_interrupt : read failed, errno = 9
  15   fd 13 is losing SIGWINCH support
  16   ------------[ cut here ]------------
  17   WARNING: at lib/list_debug.c:48 list_del+0xc6/0x100()
  18   list_del corruption, next is LIST_POISON1 (00100100)
  19   082578c8:  [<081fd77f>] dump_stack+0x22/0x24
  20   082578e0:  [<0807a18a>] warn_slowpath_common+0x5a/0x80
  21   08257908:  [<0807a23e>] warn_slowpath_fmt+0x2e/0x30
  22   08257920:  [<08172196>] list_del+0xc6/0x100
  23   08257940:  [<08060244>] free_winch+0x14/0x80
  24   08257958:  [<080606fb>] winch_interrupt+0xdb/0xe0
  25   08257978:  [<080a65b5>] handle_IRQ_event+0x35/0xe0
  26   08257998:  [<080a8717>] handle_edge_irq+0xb7/0x170
  27   082579bc:  [<08059bc4>] do_IRQ+0x34/0x50
  28   082579d4:  [<08059e1b>] sigio_handler+0x5b/0x80
  29   082579ec:  [<0806a374>] sig_handler_common+0x44/0xb0
  30   08257a68:  [<0806a538>] sig_handler+0x38/0x50
  31   08257a78:  [<0806a77c>] handle_signal+0x5c/0xa0
  32   08257a9c:  [<0806be28>] hard_handler+0x18/0x20
  33   08257aac:  [<00c14400>] 0xc14400
  34
  35 Signed-off-by: Will Newton <will.newton@gmail.com>
  36 Acked-by: WANG Cong <xiyou.wangcong@gmail.com>
  37 Cc: Jeff Dike <jdike@addtoit.com>
  38 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  39 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  40 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  41
  42 ---
  43  arch/um/drivers/line.c |    5 +++--
  44  1 file changed, 3 insertions(+), 2 deletions(-)
  45
  46 --- a/arch/um/drivers/line.c
  47 +++ b/arch/um/drivers/line.c
  48 @@ -727,6 +727,9 @@ struct winch {
  49
  50  static void free_winch(struct winch *winch, int free_irq_ok)
  51  {
  52 +       if (free_irq_ok)
  53 +               free_irq(WINCH_IRQ, winch);
  54 +
  55         list_del(&winch->list);
  56
  57         if (winch->pid != -1)
  58 @@ -735,8 +738,6 @@ static void free_winch(struct winch *win
  59                 os_close_file(winch->fd);
  60         if (winch->stack != 0)
  61                 free_stack(winch->stack, 0);
  62 -       if (free_irq_ok)
  63 -               free_irq(WINCH_IRQ, winch);
  64         kfree(winch);
  65  }
  66