git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From c330fb1ddc0a922f044989492b7fcca77ee1db46 Mon Sep 17 00:00:00 2001
   2 From: Thomas Gleixner <tglx@linutronix.de>
   3 Date: Tue, 25 Aug 2020 17:22:58 +0200
   4 Subject: XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
   5
   6 From: Thomas Gleixner <tglx@linutronix.de>
   7
   8 commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.
   9
  10 handler data is meant for interrupt handlers and not for storing irq chip
  11 specific information as some devices require handler data to store internal
  12 per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.
  13
  14 This obviously creates a conflict of interests and crashes the machine
  15 because the XEN pointer is overwritten by the driver pointer.
  16
  17 As the XEN data is not handler specific it should be stored in
  18 irqdesc::irq_data::chip_data instead.
  19
  20 A simple sed s/irq_[sg]et_handler_data/irq_[sg]et_chip_data/ cures that.
  21
  22 Cc: stable@vger.kernel.org
  23 Reported-by: Roman Shaposhnik <roman@zededa.com>
  24 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  25 Tested-by: Roman Shaposhnik <roman@zededa.com>
  26 Reviewed-by: Juergen Gross <jgross@suse.com>
  27 Link: https://lore.kernel.org/r/87lfi2yckt.fsf@nanos.tec.linutronix.de
  28 Signed-off-by: Juergen Gross <jgross@suse.com>
  29 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30
  31 ---
  32  drivers/xen/events/events_base.c |   16 ++++++++--------
  33  1 file changed, 8 insertions(+), 8 deletions(-)
  34
  35 --- a/drivers/xen/events/events_base.c
  36 +++ b/drivers/xen/events/events_base.c
  37 @@ -155,7 +155,7 @@ int get_evtchn_to_irq(unsigned evtchn)
  38  /* Get info for IRQ */
  39  struct irq_info *info_for_irq(unsigned irq)
  40  {
  41 -       return irq_get_handler_data(irq);
  42 +       return irq_get_chip_data(irq);
  43  }
  44
  45  /* Constructors for packed IRQ information. */
  46 @@ -384,7 +384,7 @@ static void xen_irq_init(unsigned irq)
  47         info->type = IRQT_UNBOUND;
  48         info->refcnt = -1;
  49
  50 -       irq_set_handler_data(irq, info);
  51 +       irq_set_chip_data(irq, info);
  52
  53         list_add_tail(&info->list, &xen_irq_list_head);
  54  }
  55 @@ -433,14 +433,14 @@ static int __must_check xen_allocate_irq
  56
  57  static void xen_free_irq(unsigned irq)
  58  {
  59 -       struct irq_info *info = irq_get_handler_data(irq);
  60 +       struct irq_info *info = irq_get_chip_data(irq);
  61
  62         if (WARN_ON(!info))
  63                 return;
  64
  65         list_del(&info->list);
  66
  67 -       irq_set_handler_data(irq, NULL);
  68 +       irq_set_chip_data(irq, NULL);
  69
  70         WARN_ON(info->refcnt > 0);
  71
  72 @@ -610,7 +610,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
  73  static void __unbind_from_irq(unsigned int irq)
  74  {
  75         int evtchn = evtchn_from_irq(irq);
  76 -       struct irq_info *info = irq_get_handler_data(irq);
  77 +       struct irq_info *info = irq_get_chip_data(irq);
  78
  79         if (info->refcnt > 0) {
  80                 info->refcnt--;
  81 @@ -1114,7 +1114,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect
  82
  83  void unbind_from_irqhandler(unsigned int irq, void *dev_id)
  84  {
  85 -       struct irq_info *info = irq_get_handler_data(irq);
  86 +       struct irq_info *info = irq_get_chip_data(irq);
  87
  88         if (WARN_ON(!info))
  89                 return;
  90 @@ -1148,7 +1148,7 @@ int evtchn_make_refcounted(unsigned int
  91         if (irq == -1)
  92                 return -ENOENT;
  93
  94 -       info = irq_get_handler_data(irq);
  95 +       info = irq_get_chip_data(irq);
  96
  97         if (!info)
  98                 return -ENOENT;
  99 @@ -1176,7 +1176,7 @@ int evtchn_get(unsigned int evtchn)
 100         if (irq == -1)
 101                 goto done;
 102
 103 -       info = irq_get_handler_data(irq);
 104 +       info = irq_get_chip_data(irq);
 105
 106         if (!info)
 107                 goto done;