request_irq() always returns -EINVAL with a NULL handler.

PATCH In review Rusty Russell 3 participants 7 messages Jan 17, 2008 – Feb 4, 2008

Subsystems (3)

Networking Network drivers IRQ

lore

Share & tools

lore

Rusty Russell

author

2008-01-17 07:00 UTC #0 lore raw

PATCH 1/1 request_irq() always returns -EINVAL with a NULL handler.

I assume that these ancient network drivers were trying to find out if an irq is available. eepro.c expecting +EBUSY was doubly wrong.

I'm not sure that can_request_irq() is the right thing, but these drivers are definitely wrong.

request_irq should BUG() on bad input, and these would have been found earlier.

Signed-off-by Rusty Russell <[email protected]>

---
 drivers/net/3c503.c |    2 +-
 drivers/net/e2100.c |    2 +-
 drivers/net/eepro.c |    2 +-
 drivers/net/hp.c    |    2 +-
 kernel/irq/manage.c |    1 +
 5 files changed, 5 insertions(+), 4 deletions(-)

drivers/net/3c503.c +1 -1

diff -r 0b7e4fbb6238 drivers/net/3c503.c
@@ -379,7 +379,7 @@ el2_open(struct net_device *dev)
 
 	outb(EGACFR_NORM, E33G_GACFR);	/* Enable RAM and interrupts. */
 	do {
-	    if (request_irq (*irqp, NULL, 0, "bogus", dev) != -EBUSY) {
+	    if (can_request_irq(*irqp, 0)) {
 		/* Twinkle the interrupt, and check if it's seen. */
 		unsigned long cookie = probe_irq_on();
 		outb_p(0x04 << ((*irqp == 9) ? 2 : *irqp), E33G_IDCFR);

drivers/net/e2100.c +1 -1

diff -r 0b7e4fbb6238 drivers/net/e2100.c
@@ -202,7 +202,7 @@ static int __init e21_probe1(struct net_
 	if (dev->irq < 2) {
 		int irqlist[] = {15,11,10,12,5,9,3,4}, i;
 		for (i = 0; i < 8; i++)
-			if (request_irq (irqlist[i], NULL, 0, "bogus", NULL) != -EBUSY) {
+			if (can_request_irq(irqlist[i], 0)) {
 				dev->irq = irqlist[i];
 				break;
 			}

drivers/net/eepro.c +1 -1

diff -r 0b7e4fbb6238 drivers/net/eepro.c
@@ -914,7 +914,7 @@ static int	eepro_grab_irq(struct net_dev
 
 		eepro_sw2bank0(ioaddr); /* Switch back to Bank 0 */
 
-		if (request_irq (*irqp, NULL, IRQF_SHARED, "bogus", dev) != EBUSY) {
+		if (can_request_irq(*irqp, IRQF_SHARED)) {
 			unsigned long irq_mask;
 			/* Twinkle the interrupt, and check if it's seen */
 			irq_mask = probe_irq_on();

drivers/net/hp.c +1 -1

diff -r 0b7e4fbb6238 drivers/net/hp.c
@@ -170,7 +170,7 @@ static int __init hp_probe1(struct net_d
 		int *irqp = wordmode ? irq_16list : irq_8list;
 		do {
 			int irq = *irqp;
-			if (request_irq (irq, NULL, 0, "bogus", NULL) != -EBUSY) {
+			if (can_request_irq(irq, 0)) {
 				unsigned long cookie = probe_irq_on();
 				/* Twinkle the interrupt, and check if it's seen. */
 				outb_p(irqmap[irq] | HP_RUN, ioaddr + HP_CONFIGURE);

kernel/irq/manage.c +1 -0

diff -r 0b7e4fbb6238 kernel/irq/manage.c
@@ -252,6 +252,7 @@ int can_request_irq(unsigned int irq, un
 
 	return !action;
 }
+EXPORT_SYMBOL(can_request_irq);
 
 void compat_irq_chip_set_default_handler(struct irq_desc *desc)
 {

Rusty Russell

author

2008-01-17 07:00 UTC #1 lore raw

PATCH 1/1 BUG_ON() bad input to request_irq

Is there any reason why these bugs should be treated gently? The caller might not want to check NR_IRQS and IRQ_NOREQUEST cases, but a NULL handler or NULL dev_id w/ shared are coding bugs.

Signed-off-by Rusty Russell <[email protected]>

---
 kernel/irq/manage.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

kernel/irq/manage.c +3 -4

diff -r c2eb8ef5a0be kernel/irq/manage.c
@@ -532,13 +532,12 @@ int request_irq(unsigned int irq, irq_ha
 	 * which interrupt is which (messes up the interrupt freeing
 	 * logic etc).
 	 */
-	if ((irqflags & IRQF_SHARED) && !dev_id)
-		return -EINVAL;
+	BUG_ON((irqflags & IRQF_SHARED) && !dev_id);
+	BUG_ON(!handler);
+
 	if (irq >= NR_IRQS)
 		return -EINVAL;
 	if (irq_desc[irq].status & IRQ_NOREQUEST)
-		return -EINVAL;
-	if (!handler)
 		return -EINVAL;
 
 	action = kmalloc(sizeof(struct irqaction), GFP_ATOMIC);

Andrew Morton

2008-01-23 22:04 UTC #2 lore raw

Re: [PATCH] BUG_ON() bad input to request_irq

Quoted 20 lines · On Thu, 17 Jan 2008 17:59:58 +1100 Rusty Russell <[email protected]> wrote:

Is there any reason why these bugs should be treated gently? The caller might not want to check NR_IRQS and IRQ_NOREQUEST cases, but a NULL handler or NULL dev_id w/ shared are coding bugs.
Signed-off-by Rusty Russell <[email protected]>
---
 kernel/irq/manage.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
diff -r c2eb8ef5a0be kernel/irq/manage.c
kernel/irq/manage.c +1 -2
@@ -532,13 +532,12 @@ int request_irq(unsigned int irq, irq_ha
 	 * which interrupt is which (messes up the interrupt freeing
 	 * logic etc).
 	 */
-	if ((irqflags & IRQF_SHARED) && !dev_id)
-		return -EINVAL;
+	BUG_ON((irqflags & IRQF_SHARED) && !dev_id);

kernel/irq/manage.c int request_irq(unsigned int irq, irq_ha · line 543

Quoted 10 lines

kernel/irq/manage.c +2 -2

+	BUG_ON(!handler);
+
 	if (irq >= NR_IRQS)
 		return -EINVAL;
 	if (irq_desc[irq].status & IRQ_NOREQUEST)
-		return -EINVAL;
-	if (!handler)
 		return -EINVAL;
 
 	action = kmalloc(sizeof(struct irqaction), GFP_ATOMIC);

If no driver is passing in args which will trigger this BUG, we presumably don't need the patch.

If some driver _is_ passing in ags which will trigger these BUGs then it is presumably working OK anyway. Taking a working system and making it go BUG is likely to upset people.

IOW: WARN_ON, please.

Rusty Russell

author

2008-01-23 22:16 UTC #3 lore raw

Re: [PATCH] BUG_ON() bad input to request_irq

Quoted 3 lines · On Thursday 24 January 2008 09:04:14 Andrew Morton wrote:

Quoted 1 line
On Thu, 17 Jan 2008 17:59:58 +1100 Rusty Russell <[email protected]>
If no driver is passing in args which will trigger this BUG, we presumably don't need the patch.

You're only thinking of current code. The BUG catches future changes, too.

Quoted 3 lines

If some driver _is_ passing in args which will trigger these BUGs then it is presumably working OK anyway. Taking a working system and making it go BUG is likely to upset people.

That's why I did the audit. See patch below which preceeded it, which Jeff hasn't responded to. Breaking his drivers might make him notice :)

Quoted 1 line

IOW: WARN_ON, please.

At end of cycles, sure, but not for 2.6.25: they're even more invisible than deprecated warnings :(

Rusty.
===
request_irq() always returns -EINVAL with a NULL handler.

I assume that these ancient network drivers were trying to find out if an irq is available. eepro.c expecting +EBUSY was doubly wrong.

Request_irq should BUG() on bad input, and these would have been found earlier.

Signed-off-by Rusty Russell <[email protected]>

---
 drivers/net/3c503.c |    2 +-
 drivers/net/e2100.c |    2 +-
 drivers/net/eepro.c |    2 +-
 drivers/net/hp.c    |    2 +-
 kernel/irq/manage.c |    1 +
 5 files changed, 5 insertions(+), 4 deletions(-)

drivers/net/3c503.c +1 -1

diff -r 0b7e4fbb6238 drivers/net/3c503.c
@@ -379,7 +379,7 @@ el2_open(struct net_device *dev)
 
 	outb(EGACFR_NORM, E33G_GACFR);	/* Enable RAM and interrupts. */
 	do {
-	    if (request_irq (*irqp, NULL, 0, "bogus", dev) != -EBUSY) {
+	    if (can_request_irq(*irqp, 0)) {
 		/* Twinkle the interrupt, and check if it's seen. */
 		unsigned long cookie = probe_irq_on();
 		outb_p(0x04 << ((*irqp == 9) ? 2 : *irqp), E33G_IDCFR);

drivers/net/e2100.c +1 -1

diff -r 0b7e4fbb6238 drivers/net/e2100.c
@@ -202,7 +202,7 @@ static int __init e21_probe1(struct net_
 	if (dev->irq < 2) {
 		int irqlist[] = {15,11,10,12,5,9,3,4}, i;
 		for (i = 0; i < 8; i++)
-			if (request_irq (irqlist[i], NULL, 0, "bogus", NULL) != -EBUSY) {
+			if (can_request_irq(irqlist[i], 0)) {
 				dev->irq = irqlist[i];
 				break;
 			}

drivers/net/eepro.c +1 -1

diff -r 0b7e4fbb6238 drivers/net/eepro.c
@@ -914,7 +914,7 @@ static int	eepro_grab_irq(struct net_dev
 
 		eepro_sw2bank0(ioaddr); /* Switch back to Bank 0 */
 
-		if (request_irq (*irqp, NULL, IRQF_SHARED, "bogus", dev) != EBUSY) {
+		if (can_request_irq(*irqp, IRQF_SHARED)) {
 			unsigned long irq_mask;
 			/* Twinkle the interrupt, and check if it's seen */
 			irq_mask = probe_irq_on();

drivers/net/hp.c +1 -1

diff -r 0b7e4fbb6238 drivers/net/hp.c
@@ -170,7 +170,7 @@ static int __init hp_probe1(struct net_d
 		int *irqp = wordmode ? irq_16list : irq_8list;
 		do {
 			int irq = *irqp;
-			if (request_irq (irq, NULL, 0, "bogus", NULL) != -EBUSY) {
+			if (can_request_irq(irq, 0)) {
 				unsigned long cookie = probe_irq_on();
 				/* Twinkle the interrupt, and check if it's seen. */
 				outb_p(irqmap[irq] | HP_RUN, ioaddr + HP_CONFIGURE);

kernel/irq/manage.c +1 -0

diff -r 0b7e4fbb6238 kernel/irq/manage.c
@@ -252,6 +252,7 @@ int can_request_irq(unsigned int irq, un
 
 	return !action;
 }
+EXPORT_SYMBOL(can_request_irq);
 
 void compat_irq_chip_set_default_handler(struct irq_desc *desc)
 {

Stephen Hemminger

2008-01-17 16:22 UTC #4 lore raw

In reply to Rusty Russell

Quoted 70 lines · On Thu, 17 Jan 2008 17:57:58 +1100 Rusty Russell <[email protected]> wrote:

I assume that these ancient network drivers were trying to find out if an irq is available. eepro.c expecting +EBUSY was doubly wrong.

I'm not sure that can_request_irq() is the right thing, but these drivers are definitely wrong.

request_irq should BUG() on bad input, and these would have been found earlier.

Signed-off-by Rusty Russell <[email protected]>

---
 drivers/net/3c503.c |    2 +-
 drivers/net/e2100.c |    2 +-
 drivers/net/eepro.c |    2 +-
 drivers/net/hp.c    |    2 +-
 kernel/irq/manage.c |    1 +
 5 files changed, 5 insertions(+), 4 deletions(-)

diff -r 0b7e4fbb6238 drivers/net/3c503.c

drivers/net/3c503.c +1 -1

@@ -379,7 +379,7 @@ el2_open(struct net_device *dev)
 
 	outb(EGACFR_NORM, E33G_GACFR);	/* Enable RAM and interrupts. */
 	do {
-	    if (request_irq (*irqp, NULL, 0, "bogus", dev) != -EBUSY) {
+	    if (can_request_irq(*irqp, 0)) {
 		/* Twinkle the interrupt, and check if it's seen. */
 		unsigned long cookie = probe_irq_on();
 		outb_p(0x04 << ((*irqp == 9) ? 2 : *irqp), E33G_IDCFR);

diff -r 0b7e4fbb6238 drivers/net/e2100.c

drivers/net/e2100.c +1 -1

@@ -202,7 +202,7 @@ static int __init e21_probe1(struct net_
 	if (dev->irq < 2) {
 		int irqlist[] = {15,11,10,12,5,9,3,4}, i;
 		for (i = 0; i < 8; i++)
-			if (request_irq (irqlist[i], NULL, 0, "bogus", NULL) != -EBUSY) {
+			if (can_request_irq(irqlist[i], 0)) {
 				dev->irq = irqlist[i];
 				break;
 			}

diff -r 0b7e4fbb6238 drivers/net/eepro.c

drivers/net/eepro.c +1 -1

@@ -914,7 +914,7 @@ static int	eepro_grab_irq(struct net_dev
 
 		eepro_sw2bank0(ioaddr); /* Switch back to Bank 0 */
 
-		if (request_irq (*irqp, NULL, IRQF_SHARED, "bogus", dev) != EBUSY) {
+		if (can_request_irq(*irqp, IRQF_SHARED)) {
 			unsigned long irq_mask;
 			/* Twinkle the interrupt, and check if it's seen */
 			irq_mask = probe_irq_on();

diff -r 0b7e4fbb6238 drivers/net/hp.c

drivers/net/hp.c +1 -1

@@ -170,7 +170,7 @@ static int __init hp_probe1(struct net_d
 		int *irqp = wordmode ? irq_16list : irq_8list;
 		do {
 			int irq = *irqp;
-			if (request_irq (irq, NULL, 0, "bogus", NULL) != -EBUSY) {
+			if (can_request_irq(irq, 0)) {
 				unsigned long cookie = probe_irq_on();
 				/* Twinkle the interrupt, and check if it's seen. */
 				outb_p(irqmap[irq] | HP_RUN, ioaddr + HP_CONFIGURE);

diff -r 0b7e4fbb6238 kernel/irq/manage.c

kernel/irq/manage.c int can_request_irq(unsigned int irq, un · line 258

Quoted 7 lines

kernel/irq/manage.c +1 -0

@@ -252,6 +252,7 @@ int can_request_irq(unsigned int irq, un
 
 	return !action;
 }
+EXPORT_SYMBOL(can_request_irq);
 
 void compat_irq_chip_set_default_handler(struct irq_desc *desc)
 {

Isn't this just inherently racy, like the old check_resource stuff that got pulled out 2.5?

Andrew Morton

2008-02-03 06:15 UTC #5 lore raw

In reply to Rusty Russell

Quoted 8 lines · On Thu, 17 Jan 2008 17:57:58 +1100 Rusty Russell <[email protected]> wrote:

I assume that these ancient network drivers were trying to find out if an irq is available. eepro.c expecting +EBUSY was doubly wrong.
I'm not sure that can_request_irq() is the right thing, but these drivers are definitely wrong.
request_irq should BUG() on bad input, and these would have been found earlier.

This breaks non-CONFIG_GENERIC_HARDIRQS architectures.

alpha:

drivers/net/3c503.c: In function 'el2_open':
drivers/net/3c503.c:382: error: implicit declaration of function 'can_request_irq'

Rusty Russell

author

2008-02-04 05:55 UTC #6 lore raw

Quoted 1 line · On Sunday 03 February 2008 17:15:02 Andrew Morton wrote:

On Thu, 17 Jan 2008 17:57:58 +1100 Rusty Russell <[email protected]>

Quoted 9 lines · wrote:

Quoted 8 lines
I assume that these ancient network drivers were trying to find out if an irq is available. eepro.c expecting +EBUSY was doubly wrong.
I'm not sure that can_request_irq() is the right thing, but these drivers are definitely wrong.
request_irq should BUG() on bad input, and these would have been found earlier.

Quoted 7 lines

This breaks non-CONFIG_GENERIC_HARDIRQS architectures.
alpha:
drivers/net/3c503.c: In function 'el2_open':
drivers/net/3c503.c:382: error: implicit declaration of function 'can_request_irq'

Since this code was non-functional before, should we just be removing the "check if irq is free" check altogether?

This is Jeff's call, I think.

Rusty.