Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 6B50C6083E
From:   Prasad Sodagudi <psodagud@codeaurora.org>
To:     tglx@linutronix.de, marc.zyngier@arm.com
Cc:     linux-kernel@vger.kernel.org, psodagud@codeaurora.org
Subject: [PATCH v2] genirq: Prevent use-after-free and work list corruption
Date:   Sun, 24 Mar 2019 07:57:04 -0700
Message-Id: <1553439424-6529-1-git-send-email-psodagud@codeaurora.org>
In-Reply-To: <fd8a18f33a3f385575048969482fd22f@codeaurora.org>
References: <fd8a18f33a3f385575048969482fd22f@codeaurora.org>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

When irq_set_affinity_notifier() replaces the notifier, then the
reference count on the old notifier is dropped which causes it to be
freed. But nothing ensures that the old notifier is not longer queued
in the work list. If it is queued this results in a use after free and
possibly in work list corruption.

Ensure that the work is canceled before the reference is dropped.

Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
---
 kernel/irq/manage.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 9ec34a2..1a1ac84 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -356,8 +356,10 @@ static void irq_affinity_notify(struct work_struct *work)
 	desc->affinity_notify = notify;
 	raw_spin_unlock_irqrestore(&desc->lock, flags);
 
-	if (old_notify)
+	if (old_notify) {
+		cancel_work_sync(&old_notify->work);
 		kref_put(&old_notify->kref, old_notify->release);
+	}
 
 	return 0;
 }
-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,\na Linux Foundation Collaborative Project