https://github.com/torvalds/linux
Revision 2d860ad76f4ee4d2eba0fe3797c8d7cdce432cc0 authored by Linus Torvalds on 13 August 2009, 20:05:10 UTC, committed by Thomas Gleixner on 13 August 2009, 21:09:27 UTC
free_irq() can remove an irqaction while the corresponding interrupt
is in progress, but free_irq() sets action->thread to NULL
unconditionally, which might lead to a NULL pointer dereference in
handle_IRQ_event() when the hard interrupt context tries to wake up
the handler thread.

Prevent this by moving the thread stop after synchronize_irq(). No
need to set action->thread to NULL either as action is going to be
freed anyway.

This fixes a boot crash reported against preempt-rt which uses the
mainline irq threads code to implement full irq threading.

[ tglx: removed local irqthread variable ]

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
1 parent 3493e84
History
Tip revision: 2d860ad76f4ee4d2eba0fe3797c8d7cdce432cc0 authored by Linus Torvalds on 13 August 2009, 20:05:10 UTC
genirq: prevent wakeup of freed irq thread
Tip revision: 2d860ad
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 952 bytes
.mailmap -rw-r--r-- 3.9 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.8 KB
Kbuild -rw-r--r-- 2.4 KB
MAINTAINERS -rw-r--r-- 148.2 KB
Makefile -rw-r--r-- 53.9 KB
README -rw-r--r-- 17.0 KB
REPORTING-BUGS -rw-r--r-- 3.1 KB

README

back to top