* [PATCH -next resend] scsi: hisi_sas: drop free_irq of devm_request_irq allocated irq
@ 2021-05-19 13:05 Yang Yingliang
2021-05-19 13:17 ` John Garry
2021-05-22 4:40 ` Martin K. Petersen
0 siblings, 2 replies; 3+ messages in thread
From: Yang Yingliang @ 2021-05-19 13:05 UTC (permalink / raw)
To: linux-kernel, linux-scsi
Cc: john.garry, jejb, martin.petersen, chenxiang66, luojiaxing
irq allocated with devm_request_irq should not be freed using
free_irq, because doing so causes a dangling pointer, and a
subsequent double free.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 499c770d405c..e95408314078 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -4811,14 +4811,14 @@ hisi_sas_v3_destroy_irqs(struct pci_dev *pdev, struct hisi_hba *hisi_hba)
{
int i;
- free_irq(pci_irq_vector(pdev, 1), hisi_hba);
- free_irq(pci_irq_vector(pdev, 2), hisi_hba);
- free_irq(pci_irq_vector(pdev, 11), hisi_hba);
+ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 1), hisi_hba);
+ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 2), hisi_hba);
+ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 11), hisi_hba);
for (i = 0; i < hisi_hba->cq_nvecs; i++) {
struct hisi_sas_cq *cq = &hisi_hba->cq[i];
int nr = hisi_sas_intr_conv ? 16 : 16 + i;
- free_irq(pci_irq_vector(pdev, nr), cq);
+ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, nr), cq);
}
pci_free_irq_vectors(pdev);
}
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH -next resend] scsi: hisi_sas: drop free_irq of devm_request_irq allocated irq
2021-05-19 13:05 [PATCH -next resend] scsi: hisi_sas: drop free_irq of devm_request_irq allocated irq Yang Yingliang
@ 2021-05-19 13:17 ` John Garry
2021-05-22 4:40 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: John Garry @ 2021-05-19 13:17 UTC (permalink / raw)
To: Yang Yingliang, linux-kernel, linux-scsi
Cc: jejb, martin.petersen, chenxiang66, luojiaxing
On 19/05/2021 14:05, Yang Yingliang wrote:
> irq allocated with devm_request_irq should not be freed using
> free_irq, because doing so causes a dangling pointer, and a
> subsequent double free.
>
> Reported-by: Hulk Robot<hulkci@huawei.com>
> Signed-off-by: Yang Yingliang<yangyingliang@huawei.com>
> ---
Acked-by: John Garry <john.garry@huawei.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH -next resend] scsi: hisi_sas: drop free_irq of devm_request_irq allocated irq
2021-05-19 13:05 [PATCH -next resend] scsi: hisi_sas: drop free_irq of devm_request_irq allocated irq Yang Yingliang
2021-05-19 13:17 ` John Garry
@ 2021-05-22 4:40 ` Martin K. Petersen
1 sibling, 0 replies; 3+ messages in thread
From: Martin K. Petersen @ 2021-05-22 4:40 UTC (permalink / raw)
To: Yang Yingliang, linux-scsi, linux-kernel
Cc: Martin K . Petersen, john.garry, jejb, luojiaxing, chenxiang66
On Wed, 19 May 2021 21:05:19 +0800, Yang Yingliang wrote:
> irq allocated with devm_request_irq should not be freed using
> free_irq, because doing so causes a dangling pointer, and a
> subsequent double free.
Applied to 5.13/scsi-fixes, thanks!
[1/1] scsi: hisi_sas: drop free_irq of devm_request_irq allocated irq
https://git.kernel.org/mkp/scsi/c/7907a021e4bb
--
Martin K. Petersen Oracle Linux Engineering
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-05-22 4:41 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-19 13:05 [PATCH -next resend] scsi: hisi_sas: drop free_irq of devm_request_irq allocated irq Yang Yingliang
2021-05-19 13:17 ` John Garry
2021-05-22 4:40 ` Martin K. Petersen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).