| commit | 59c39840f5abf4a71e1810a8da71aaccd6c17d26 | |
| author | Prasad Sodagudi <psodagud@codeaurora.org> | |
| Sun, 24 Mar 2019 14:57:04 +0000 (24 07:57 -0700) | ||
| committer | Thomas Gleixner <tglx@linutronix.de> | |
| Sun, 24 Mar 2019 21:13:17 +0000 (24 22:13 +0100) | ||
| tree | c0590b6b701c9ad5377e5202e903397a9deefc8c | treesnapshot (tar.gz zip) |
| parent | 8c2ffd9174779014c3fe1f96d9dc3641d9175f00 | commitdiff |
genirq: Prevent use-after-free and work list corruption
When irq_set_affinity_notifier() replaces the notifier, then the
reference count on the old notifier is dropped which causes it to be
freed. But nothing ensures that the old notifier is not longer queued
in the work list. If it is queued this results in a use after free and
possibly in work list corruption.
Ensure that the work is canceled before the reference is dropped.
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: marc.zyngier@arm.com
Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeaurora.org
When irq_set_affinity_notifier() replaces the notifier, then the
reference count on the old notifier is dropped which causes it to be
freed. But nothing ensures that the old notifier is not longer queued
in the work list. If it is queued this results in a use after free and
possibly in work list corruption.
Ensure that the work is canceled before the reference is dropped.
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: marc.zyngier@arm.com
Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeaurora.org
| kernel/irq/manage.c | diffblobblamehistory |