[PATCH 4.9 142/164] genirq: Fix chained interrupt data ordering

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.9 142/164] genirq: Fix chained interrupt data ordering
Date	2017-05-23 23:30 +0200
Message-ID	<tKpxo-AI-23@gated-at.bofh.it> (permalink)
References	<tKoBk-8ko-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit 2c4569ca26986d18243f282dd727da27e9adae4c upstream.

irq_set_chained_handler_and_data() sets up the chained interrupt and then
stores the handler data.

That's racy against an immediate interrupt which gets handled before the
store of the handler data happened. The handler will dereference a NULL
pointer and crash.

Cure it by storing handler data before installing the chained handler.

Reported-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/irq/chip.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -877,8 +877,8 @@ irq_set_chained_handler_and_data(unsigne
 	if (!desc)
 		return;
 
-	__irq_do_set_handler(desc, handle, 1, NULL);
 	desc->irq_common_data.handler_data = data;
+	__irq_do_set_handler(desc, handle, 1, NULL);
 
 	irq_put_desc_busunlock(desc, flags);
 }

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 4.9 142/164] genirq: Fix chained interrupt data ordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:30 +0200

csiph-web