]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
fixes for 5.0
authorSasha Levin <sashal@kernel.org>
Thu, 9 May 2019 01:16:20 +0000 (21:16 -0400)
committerSasha Levin <sashal@kernel.org>
Thu, 9 May 2019 01:16:20 +0000 (21:16 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-5.0/genirq-prevent-use-after-free-and-work-list-corrupti.patch [new file with mode: 0644]
queue-5.0/series

diff --git a/queue-5.0/genirq-prevent-use-after-free-and-work-list-corrupti.patch b/queue-5.0/genirq-prevent-use-after-free-and-work-list-corrupti.patch
new file mode 100644 (file)
index 0000000..e322536
--- /dev/null
@@ -0,0 +1,43 @@
+From b3ee61f08e0b1eb01c3122da0769c3d20bbb93df Mon Sep 17 00:00:00 2001
+From: Prasad Sodagudi <psodagud@codeaurora.org>
+Date: Sun, 24 Mar 2019 07:57:04 -0700
+Subject: genirq: Prevent use-after-free and work list corruption
+
+[ Upstream commit 59c39840f5abf4a71e1810a8da71aaccd6c17d26 ]
+
+When irq_set_affinity_notifier() replaces the notifier, then the
+reference count on the old notifier is dropped which causes it to be
+freed. But nothing ensures that the old notifier is not longer queued
+in the work list. If it is queued this results in a use after free and
+possibly in work list corruption.
+
+Ensure that the work is canceled before the reference is dropped.
+
+Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: marc.zyngier@arm.com
+Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/manage.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 84b54a17b95d3..df557ec20a6f9 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -356,8 +356,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify)
+       desc->affinity_notify = notify;
+       raw_spin_unlock_irqrestore(&desc->lock, flags);
+-      if (old_notify)
++      if (old_notify) {
++              cancel_work_sync(&old_notify->work);
+               kref_put(&old_notify->kref, old_notify->release);
++      }
+       return 0;
+ }
+-- 
+2.20.1
+
index b5b03ff5db5891e02ab1475980212ff8ab6ddeee..2fd74b6d7ea5b1373283cfdb83aeb24c8f9222ba 100644 (file)
@@ -70,3 +70,4 @@ platform-x86-pmc_atom-drop-__initconst-on-dmi-table.patch
 nfsv4.1-fix-incorrect-return-value-in-copy_file_rang.patch
 perf-core-fix-perf_event_disable_inatomic-race.patch
 iommu-amd-set-exclusion-range-correctly.patch
+genirq-prevent-use-after-free-and-work-list-corrupti.patch