Hi Greg,

We forgot to mark 59c39840f5abf4a71e1 for -stable, please apply. It should apply cleanly all the way back to v3.0.

Thanks,

Ingo

----- Forwarded message from tip-bot for Prasad Sodagudi tipbot@zytor.com -----

Date: Sun, 24 Mar 2019 14:16:45 -0700 From: tip-bot for Prasad Sodagudi tipbot@zytor.com To: linux-tip-commits@vger.kernel.org Cc: mingo@kernel.org, hpa@zytor.com, psodagud@codeaurora.org, tglx@linutronix.de, linux-kernel@vger.kernel.org Subject: [tip:irq/core] genirq: Prevent use-after-free and work list corruption

Commit-ID: 59c39840f5abf4a71e1810a8da71aaccd6c17d26 Gitweb: https://git.kernel.org/tip/59c39840f5abf4a71e1810a8da71aaccd6c17d26 Author: Prasad Sodagudi psodagud@codeaurora.org AuthorDate: Sun, 24 Mar 2019 07:57:04 -0700 Committer: Thomas Gleixner tglx@linutronix.de CommitDate: Sun, 24 Mar 2019 22:13:17 +0100

genirq: Prevent use-after-free and work list corruption

When irq_set_affinity_notifier() replaces the notifier, then the reference count on the old notifier is dropped which causes it to be freed. But nothing ensures that the old notifier is not longer queued in the work list. If it is queued this results in a use after free and possibly in work list corruption.

Ensure that the work is canceled before the reference is dropped.

Signed-off-by: Prasad Sodagudi psodagud@codeaurora.org Signed-off-by: Thomas Gleixner tglx@linutronix.de Cc: marc.zyngier@arm.com Link: https://lkml.kernel.org/r/1553439424-6529-1-git-send-email-psodagud@codeauro...

--- kernel/irq/manage.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c index 1401afa0d58a..53a081392115 100644 --- a/kernel/irq/manage.c +++ b/kernel/irq/manage.c @@ -357,8 +357,10 @@ irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify) desc->affinity_notify = notify; raw_spin_unlock_irqrestore(&desc->lock, flags);

- if (old_notify) + if (old_notify) { + cancel_work_sync(&old_notify->work); kref_put(&old_notify->kref, old_notify->release); + }

return 0; }

----- End forwarded message -----