Revision fbf8d71742557abaf558d8efb96742d442720cc2 authored by Mathias Krause on 22 February 2024, 14:26:54 UTC, committed by Dmitry Torokhov on 07 March 2024, 23:29:52 UTC
Calling irq_domain_remove() will lead to freeing the IRQ domain prematurely. The domain is still referenced and will be attempted to get used via rmi_free_function_list() -> rmi_unregister_function() -> irq_dispose_mapping() -> irq_get_irq_data()'s ->domain pointer. With PaX's MEMORY_SANITIZE this will lead to an access fault when attempting to dereference embedded pointers, as in Torsten's report that was faulting on the 'domain->ops->unmap' test. Fix this by releasing the IRQ domain only after all related IRQs have been deactivated. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Reported-by: Torsten Hilbrich <torsten.hilbrich@secunet.com> Signed-off-by: Mathias Krause <minipli@grsecurity.net> Link: https://lore.kernel.org/r/20240222142654.856566-1-minipli@grsecurity.net Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
1 parent 963465a
File | Mode | Size |
---|---|---|
Documentation | ||
LICENSES | ||
arch | ||
block | ||
certs | ||
crypto | ||
drivers | ||
fs | ||
include | ||
init | ||
io_uring | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
rust | ||
samples | ||
scripts | ||
security | ||
sound | ||
tools | ||
usr | ||
virt | ||
.clang-format | -rw-r--r-- | 20.1 KB |
.cocciconfig | -rw-r--r-- | 59 bytes |
.get_maintainer.ignore | -rw-r--r-- | 151 bytes |
.gitattributes | -rw-r--r-- | 105 bytes |
.gitignore | -rw-r--r-- | 2.0 KB |
.mailmap | -rw-r--r-- | 35.4 KB |
.rustfmt.toml | -rw-r--r-- | 369 bytes |
COPYING | -rw-r--r-- | 496 bytes |
CREDITS | -rw-r--r-- | 100.3 KB |
Kbuild | -rw-r--r-- | 2.5 KB |
Kconfig | -rw-r--r-- | 555 bytes |
MAINTAINERS | -rw-r--r-- | 701.1 KB |
Makefile | -rw-r--r-- | 70.0 KB |
README | -rw-r--r-- | 727 bytes |
Computing file changes ...