Messages in this thread | | | Date | Tue, 15 Aug 2023 13:38:49 +0300 | From | Andy Shevchenko <> | Subject | Re: [PATCH 1/4] genirq/irq_sim: dispose of remaining mappings before removing the domain |
| |
On Sat, Aug 12, 2023 at 09:44:54PM +0200, Bartosz Golaszewski wrote: > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> > > If the device providing simulated interrupts is unbound (real life > example: gpio-sim is disabled with users that didn't free their irqs) > and removes the simulated domain while interrupts are still requested, > we will hit memory issues when they are eventually freed and the > mappings destroyed in the process. > > Specifically we'll access freed memory in __irq_domain_deactivate_irq(). > > Dispose of all mappings before removing the simulator domain.
...
> +#include <linux/list.h>
Maybe ordered?
> #include <linux/irq.h> > #include <linux/irq_sim.h> > #include <linux/irq_work.h>
...
> @@ -16,12 +17,14 @@ struct irq_sim_work_ctx { > unsigned int irq_count; > unsigned long *pending; > struct irq_domain *domain; > + struct list_head irqs; > }; > > struct irq_sim_irq_ctx { > int irqnum; > bool enabled; > struct irq_sim_work_ctx *work_ctx;
> + struct list_head siblings;
You can reduce the code size by moving this to be the first member. Not sure about struct irq_sim_work_ctx, you can play with bloat-o-meter.
> };
-- With Best Regards, Andy Shevchenko
| |