| From 2c4569ca26986d18243f282dd727da27e9adae4c Mon Sep 17 00:00:00 2001 |
| From: Thomas Gleixner <tglx@linutronix.de> |
| Date: Thu, 11 May 2017 13:54:11 +0200 |
| Subject: genirq: Fix chained interrupt data ordering |
| |
| From: Thomas Gleixner <tglx@linutronix.de> |
| |
| commit 2c4569ca26986d18243f282dd727da27e9adae4c upstream. |
| |
| irq_set_chained_handler_and_data() sets up the chained interrupt and then |
| stores the handler data. |
| |
| That's racy against an immediate interrupt which gets handled before the |
| store of the handler data happened. The handler will dereference a NULL |
| pointer and crash. |
| |
| Cure it by storing handler data before installing the chained handler. |
| |
| Reported-by: Borislav Petkov <bp@alien8.de> |
| Signed-off-by: Thomas Gleixner <tglx@linutronix.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| kernel/irq/chip.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/kernel/irq/chip.c |
| +++ b/kernel/irq/chip.c |
| @@ -877,8 +877,8 @@ irq_set_chained_handler_and_data(unsigne |
| if (!desc) |
| return; |
| |
| - __irq_do_set_handler(desc, handle, 1, NULL); |
| desc->irq_common_data.handler_data = data; |
| + __irq_do_set_handler(desc, handle, 1, NULL); |
| |
| irq_put_desc_busunlock(desc, flags); |
| } |
