um: Add winch to winch_handlers before registering winch IRQ

[ Upstream commit a0fbbd36c156b9f7b2276871d499c9943dfe5101 ]

Registering a winch IRQ is racy, an interrupt may occur before the winch is
added to the winch_handlers list.

If that happens, register_winch_irq() adds to that list a winch that is
scheduled to be (or has already been) freed, causing a panic later in
winch_cleanup().

Avoid the race by adding the winch to the winch_handlers list before
registering the IRQ, and rolling back if um_request_irq() fails.

Fixes: 42a359e31a0e ("uml: SIGIO support cleanup")
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 14ad9f495fe6937a9d0a5a164619a84e82a89859..37e96ba0f5fb14f89c9e91aa5cdf5707f4d20570 100644 (file)
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -668,24 +668,26 @@ void register_winch_irq(int fd, int tty_fd, int pid, struct tty_port *port,
                goto cleanup;
        }
 
-       *winch = ((struct winch) { .list        = LIST_HEAD_INIT(winch->list),
-                                  .fd          = fd,
+       *winch = ((struct winch) { .fd          = fd,
                                   .tty_fd      = tty_fd,
                                   .pid         = pid,
                                   .port        = port,
                                   .stack       = stack });
 
+       spin_lock(&winch_handler_lock);
+       list_add(&winch->list, &winch_handlers);
+       spin_unlock(&winch_handler_lock);
+
        if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
                           IRQF_SHARED, "winch", winch) < 0) {
                printk(KERN_ERR "register_winch_irq - failed to register "
                       "IRQ\n");
+               spin_lock(&winch_handler_lock);
+               list_del(&winch->list);
+               spin_unlock(&winch_handler_lock);
                goto out_free;
        }
 
-       spin_lock(&winch_handler_lock);
-       list_add(&winch->list, &winch_handlers);
-       spin_unlock(&winch_handler_lock);
-
        return;
 
  out_free: