]> www.infradead.org Git - users/dwmw2/linux.git/commit
mmc: meson-gx: Free irq in release() callback
authorRemi Pommarel <repk@triplefau.lt>
Thu, 10 Jan 2019 23:01:35 +0000 (00:01 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 31 Jan 2019 07:15:39 +0000 (08:15 +0100)
commit2c2088e9bb17bebcad7f2bc5adac552dd7fe80a9
tree987ed4d4a6d9f8137237dfbbdbbe80f170c1c22d
parent5f72f790e59ce1a76e0a16e6f4668d63ce225d63
mmc: meson-gx: Free irq in release() callback

commit bb364890323cca6e43f13e86d190ebf34a7d8cea upstream.

Because the irq was requested through device managed resources API
(devm_request_threaded_irq()) it was freed after meson_mmc_remove()
completion, thus after mmc_free_host() has reclaimed meson_host memory.
As this irq is IRQF_SHARED, while using CONFIG_DEBUG_SHIRQ, its handler
get called by free_irq(). So meson_mmc_irq() was called after the
meson_host memory reclamation and was using invalid memory.

We ended up with the following scenario:
device_release_driver()
meson_mmc_remove()
mmc_free_host() /* Freeing host memory */
...
devres_release_all()
devm_irq_release()
__free_irq()
meson_mmc_irq() /* Uses freed memory */

To avoid this, the irq is released in meson_mmc_remove() and in
mseon_mmc_probe() error path before mmc_free_host() gets called.

Reported-by: Elie Roudninski <xademax@gmail.com>
Signed-off-by: Remi Pommarel <repk@triplefau.lt>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/mmc/host/meson-gx-mmc.c