korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-13 14:04:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

gpio: sim: dispose of irq mappings before destroying the irq_sim domain

Browse Source 
If a GPIO simulator device is unbound with interrupts still requested,
we will hit a use-after-free issue in __irq_domain_deactivate_irq(). The
owner of the irq domain must dispose of all mappings before destroying
the domain object.

Fixes: cb8c474e79 ("gpio: sim: new testing module")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
This commit is contained in:
Bartosz Golaszewski 2023-08-22 21:29:42 +02:00
parent 706a741595
commit ab4109f91b
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/gpio/gpio-sim.c
View File

@ -291,6 +291,15 @@ static void gpio_sim_mutex_destroy(void *data)
mutex_destroy(lock);
}
static void gpio_sim_dispose_mappings(void *data)
{
struct gpio_sim_chip *chip = data;
unsigned int i;
for (i = 0; i < chip->gc.ngpio; i++)
irq_dispose_mapping(irq_find_mapping(chip->irq_sim, i));
}
static void gpio_sim_sysfs_remove(void *data)
{
struct gpio_sim_chip *chip = data;
@ -406,6 +415,10 @@ static int gpio_sim_add_bank(struct fwnode_handle *swnode, struct device *dev)
if (IS_ERR(chip->irq_sim))
return PTR_ERR(chip->irq_sim);
ret = devm_add_action_or_reset(dev, gpio_sim_dispose_mappings, chip);
if (ret)
return ret;
mutex_init(&chip->lock);
ret = devm_add_action_or_reset(dev, gpio_sim_mutex_destroy,
&chip->lock);