mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-24 11:25:43 +00:00
Code Issues Releases Wiki Activity

gpio: sim: dispose of irq mappings before destroying the irq_sim domain

Browse source 
If a GPIO simulator device is unbound with interrupts still requested,
we will hit a use-after-free issue in __irq_domain_deactivate_irq(). The
owner of the irq domain must dispose of all mappings before destroying
the domain object.

Fixes: cb8c474e79 ("gpio: sim: new testing module")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
This commit is contained in:
Bartosz Golaszewski 2023-08-22 21:29:42 +02:00
parent 706a741595
commit ab4109f91b
1 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/gpio/gpio-sim.c
View file

@ -291,6 +291,15 @@ static void gpio_sim_mutex_destroy(void *data)
mutex_destroy(lock);
}
static void gpio_sim_dispose_mappings(void *data)
{
struct gpio_sim_chip *chip = data;
unsigned int i;
for (i = 0; i < chip->gc.ngpio; i++)
irq_dispose_mapping(irq_find_mapping(chip->irq_sim, i));
}
static void gpio_sim_sysfs_remove(void *data)
{
struct gpio_sim_chip *chip = data;
@ -406,6 +415,10 @@ static int gpio_sim_add_bank(struct fwnode_handle *swnode, struct device *dev)
if (IS_ERR(chip->irq_sim))
return PTR_ERR(chip->irq_sim);
ret = devm_add_action_or_reset(dev, gpio_sim_dispose_mappings, chip);
if (ret)
return ret;
mutex_init(&chip->lock);
ret = devm_add_action_or_reset(dev, gpio_sim_mutex_destroy,
&chip->lock);