Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cc8c3b78 authored by Thomas Gleixner's avatar Thomas Gleixner
Browse files

genirq: Protect access to irq_desc->action in can_request_irq() 



can_request_irq() accesses and dereferences irq_desc->action w/o
holding irq_desc->lock. So action can be freed on another CPU before
it's dereferenced. Unlikely, but ...

Protect it with desc->lock.

Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent 0b1adaa0

kernel/irq/manage.c

+4 −0
Original line number Diff line number Diff line
@@ -382,6 +382,7 @@ int can_request_irq(unsigned int irq, unsigned long irqflags) 
{

	struct irq_desc *desc = irq_to_desc(irq);

	struct irqaction *action;

	unsigned long flags;



	if (!desc)

		return 0;
@@ -389,11 +390,14 @@ int can_request_irq(unsigned int irq, unsigned long irqflags) 
	if (desc->status & IRQ_NOREQUEST)

		return 0;



	raw_spin_lock_irqsave(&desc->lock, flags);

	action = desc->action;

	if (action)

		if (irqflags & action->flags & IRQF_SHARED)

			action = NULL;



	raw_spin_unlock_irqrestore(&desc->lock, flags);



	return !action;

}