* FAILED: patch "[PATCH] PCI/MSI: Destroy sysfs before freeing entries" failed to apply to 5.14-stable tree
@ 2021-11-15 12:41 gregkh
2021-11-15 19:37 ` [PATCH v4.14y - v5.14y] PCI/MSI: Destroy sysfs before freeing entries Thomas Gleixner
0 siblings, 1 reply; 3+ messages in thread
From: gregkh @ 2021-11-15 12:41 UTC (permalink / raw)
To: tglx, gregkh, helgaas; +Cc: stable
The patch below does not apply to the 5.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3735459037114d31e5acd9894fad9aed104231a0 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 9 Nov 2021 14:53:57 +0100
Subject: [PATCH] PCI/MSI: Destroy sysfs before freeing entries
free_msi_irqs() frees the MSI entries before destroying the sysfs entries
which are exposing them. Nothing prevents a concurrent free while a sysfs
file is read and accesses the possibly freed entry.
Move the sysfs release ahead of freeing the entries.
Fixes: 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Bjorn Helgaas <helgaas@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87sfw5305m.ffs@tglx
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 70433013897b..48e3f4e47b29 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -368,6 +368,11 @@ static void free_msi_irqs(struct pci_dev *dev)
for (i = 0; i < entry->nvec_used; i++)
BUG_ON(irq_has_action(entry->irq + i));
+ if (dev->msi_irq_groups) {
+ msi_destroy_sysfs(&dev->dev, dev->msi_irq_groups);
+ dev->msi_irq_groups = NULL;
+ }
+
pci_msi_teardown_msi_irqs(dev);
list_for_each_entry_safe(entry, tmp, msi_list, list) {
@@ -379,11 +384,6 @@ static void free_msi_irqs(struct pci_dev *dev)
list_del(&entry->list);
free_msi_entry(entry);
}
-
- if (dev->msi_irq_groups) {
- msi_destroy_sysfs(&dev->dev, dev->msi_irq_groups);
- dev->msi_irq_groups = NULL;
- }
}
static void pci_intx_for_msi(struct pci_dev *dev, int enable)
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH v4.14y - v5.14y] PCI/MSI: Destroy sysfs before freeing entries
2021-11-15 12:41 FAILED: patch "[PATCH] PCI/MSI: Destroy sysfs before freeing entries" failed to apply to 5.14-stable tree gregkh
@ 2021-11-15 19:37 ` Thomas Gleixner
2021-11-19 14:03 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Thomas Gleixner @ 2021-11-15 19:37 UTC (permalink / raw)
To: gregkh, helgaas; +Cc: stable
Commit 3735459037114d31e5acd9894fad9aed104231a0 uptream
free_msi_irqs() frees the MSI entries before destroying the sysfs entries
which are exposing them. Nothing prevents a concurrent free while a sysfs
file is read and accesses the possibly freed entry.
Move the sysfs release ahead of freeing the entries.
Fixes: 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87sfw5305m.ffs@tglx
---
Backport applies to 4.14.y up to 5.14.y series
---
drivers/pci/msi.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -396,18 +396,6 @@ static void free_msi_irqs(struct pci_dev
for (i = 0; i < entry->nvec_used; i++)
BUG_ON(irq_has_action(entry->irq + i));
- pci_msi_teardown_msi_irqs(dev);
-
- list_for_each_entry_safe(entry, tmp, msi_list, list) {
- if (entry->msi_attrib.is_msix) {
- if (list_is_last(&entry->list, msi_list))
- iounmap(entry->mask_base);
- }
-
- list_del(&entry->list);
- free_msi_entry(entry);
- }
-
if (dev->msi_irq_groups) {
sysfs_remove_groups(&dev->dev.kobj, dev->msi_irq_groups);
msi_attrs = dev->msi_irq_groups[0]->attrs;
@@ -423,6 +411,18 @@ static void free_msi_irqs(struct pci_dev
kfree(dev->msi_irq_groups);
dev->msi_irq_groups = NULL;
}
+
+ pci_msi_teardown_msi_irqs(dev);
+
+ list_for_each_entry_safe(entry, tmp, msi_list, list) {
+ if (entry->msi_attrib.is_msix) {
+ if (list_is_last(&entry->list, msi_list))
+ iounmap(entry->mask_base);
+ }
+
+ list_del(&entry->list);
+ free_msi_entry(entry);
+ }
}
static void pci_intx_for_msi(struct pci_dev *dev, int enable)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v4.14y - v5.14y] PCI/MSI: Destroy sysfs before freeing entries
2021-11-15 19:37 ` [PATCH v4.14y - v5.14y] PCI/MSI: Destroy sysfs before freeing entries Thomas Gleixner
@ 2021-11-19 14:03 ` Greg KH
0 siblings, 0 replies; 3+ messages in thread
From: Greg KH @ 2021-11-19 14:03 UTC (permalink / raw)
To: Thomas Gleixner; +Cc: helgaas, stable
On Mon, Nov 15, 2021 at 08:37:43PM +0100, Thomas Gleixner wrote:
> Commit 3735459037114d31e5acd9894fad9aed104231a0 uptream
>
> free_msi_irqs() frees the MSI entries before destroying the sysfs entries
> which are exposing them. Nothing prevents a concurrent free while a sysfs
> file is read and accesses the possibly freed entry.
>
> Move the sysfs release ahead of freeing the entries.
>
> Fixes: 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects")
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/r/87sfw5305m.ffs@tglx
> ---
> Backport applies to 4.14.y up to 5.14.y series
All now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-11-19 14:03 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-15 12:41 FAILED: patch "[PATCH] PCI/MSI: Destroy sysfs before freeing entries" failed to apply to 5.14-stable tree gregkh
2021-11-15 19:37 ` [PATCH v4.14y - v5.14y] PCI/MSI: Destroy sysfs before freeing entries Thomas Gleixner
2021-11-19 14:03 ` Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.