PCI/MSI: Destroy sysfs before freeing entries
Subsystems (2)
free_msi_irqs() frees the MSI entries before destroying the sysfs entries which are exposing them. Nothing prevents a concurrent free while a sysfs file is read and accesses the possibly freed entry.
Move the sysfs release ahead of freeing the entries.
--- drivers/pci/msi.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/pci/msi.c +5 -5
@@ -370,6 +370,11 @@ static void free_msi_irqs(struct pci_devfor (i =0 ; i < entry->nvec_used; i++)BUG_ON (irq_has_action (entry->irq + i)); +if (dev->msi_irq_groups) { +msi_destroy_sysfs (&dev->dev, dev->msi_irq_groups); + dev->msi_irq_groups =NULL ; + } +pci_msi_teardown_msi_irqs (dev);list_for_each_entry_safe (entry, tmp, msi_list, list) {
@@ -381,11 +386,6 @@ static void free_msi_irqs(struct pci_devlist_del (&entry->list);free_msi_entry (entry); } - -if (dev->msi_irq_groups) { -msi_destroy_sysfs (&dev->dev, dev->msi_irq_groups); - dev->msi_irq_groups =NULL ; - } }static void pci_intx_for_msi (struct pci_dev *dev,int enable)
Quoted 4 lines · Thomas Gleixner
free_msi_irqs()frees the MSI entries before destroying the sysfs entries which are exposing them. Nothing prevents a concurrent free while a sysfs file is read and accesses the possibly freed entry.
Quoted 8 lines
Move the sysfs release ahead of freeing the entries.
Fixes 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects")Signed-off-by Thomas Gleixner <[email protected]>--- drivers/pci/msi.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
The following commit has been merged into the irq/urgent branch of tip:
The following commit has been merged into the irq/urgent branch of tip:
Commit-ID: 3735459037114d31e5acd9894fad9aed104231a0 Gitweb: https://git.kernel.org/tip/3735459037114d31e5acd9894fad9aed104231a0 Author: Thomas Gleixner <[email protected]> AuthorDate: Tue, 09 Nov 2021 14:53:57 +01:00 Committer: Thomas Gleixner <[email protected]> CommitterDate: Thu, 11 Nov 2021 09:50:31 +01:00
PCI/MSI: Destroy sysfs before freeing entries
free_msi_irqs() frees the MSI entries before destroying the sysfs entries which are exposing them. Nothing prevents a concurrent free while a sysfs file is read and accesses the possibly freed entry.
Move the sysfs release ahead of freeing the entries.
--- drivers/pci/msi.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/pci/msi.c +5 -5
@@ -368,6 +368,11 @@ static void free_msi_irqs(struct pci_dev *dev)for (i =0 ; i < entry->nvec_used; i++)BUG_ON (irq_has_action (entry->irq + i)); +if (dev->msi_irq_groups) { +msi_destroy_sysfs (&dev->dev, dev->msi_irq_groups); + dev->msi_irq_groups =NULL ; + } +pci_msi_teardown_msi_irqs (dev);list_for_each_entry_safe (entry, tmp, msi_list, list) {
@@ -379,11 +384,6 @@ static void free_msi_irqs(struct pci_dev *dev)list_del (&entry->list);free_msi_entry (entry); } - -if (dev->msi_irq_groups) { -msi_destroy_sysfs (&dev->dev, dev->msi_irq_groups); - dev->msi_irq_groups =NULL ; - } }static void pci_intx_for_msi (struct pci_dev *dev,int enable)