Messages in this thread | | | From | Bartosz Golaszewski <> | Date | Tue, 22 Aug 2023 14:16:44 +0200 | Subject | Re: [PATCH 1/2] gpio: sim: dispose of irq mappings before destroying the irq_sim domain |
| |
On Tue, Aug 22, 2023 at 2:12 PM Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote: > > On Tue, Aug 22, 2023 at 09:51:21AM +0200, Bartosz Golaszewski wrote: > > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> > > > > If a GPIO simulator device is unbound with interrupts still requested, > > we will hit a use-after-free issue in __irq_domain_deactivate_irq(). The > > owner of the irq domain must dispose of all mappings before destroying > > the domain object. > > ... > > > +static void gpio_sim_dispose_mappings(void *data) > > +{ > > + struct gpio_sim_chip *chip = data; > > + unsigned int i, irq; > > + > > + for (i = 0; i < chip->gc.ngpio; i++) { > > + irq = irq_find_mapping(chip->irq_sim, i); > > > + if (irq) > > This duplicates check in the following call. >
Ah so it can be a direct call:
irq_dispose_mapping(irq_find_mapping(chip->irq_sim, i));
?
Bart
> > + irq_dispose_mapping(irq); > > + } > > +} > > -- > With Best Regards, > Andy Shevchenko > >
| |