Commit e3beca48 authored by Thomas Gleixner's avatar Thomas Gleixner
Browse files

irqdomain/treewide: Keep firmware node unconditionally allocated 



Quite some non OF/ACPI users of irqdomains allocate firmware nodes of type
IRQCHIP_FWNODE_NAMED or IRQCHIP_FWNODE_NAMED_ID and free them right after
creating the irqdomain. The only purpose of these FW nodes is to convey
name information. When this was introduced the core code did not store the
pointer to the node in the irqdomain. A recent change stored the firmware
node pointer in irqdomain for other reasons and missed to notice that the
usage sites which do the alloc_fwnode/create_domain/free_fwnode sequence
are broken by this. Storing a dangling pointer is dangerous itself, but in
case that the domain is destroyed later on this leads to a double free.

Remove the freeing of the firmware node after creating the irqdomain from
all affected call sites to cure this.

Fixes: 711419e5 ("irqdomain: Add the missing assignment of domain->fwnode for named fwnode")
Reported-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Acked-by: default avatarBjorn Helgaas <bhelgaas@google.com>
Acked-by: default avatarMarc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/873661qakd.fsf@nanos.tec.linutronix.de
parent dcb7fd82

arch/mips/pci/pci-xtalk-bridge.c

+3 −2
Original line number Diff line number Diff line
@@ -627,9 +627,10 @@ static int bridge_probe(struct platform_device *pdev) 
		return -ENOMEM;

	domain = irq_domain_create_hierarchy(parent, 0, 8, fn,

					     &bridge_domain_ops, NULL);

	if (!domain) {

		irq_domain_free_fwnode(fn);

	if (!domain)

		return -ENOMEM;

	}



	pci_set_flags(PCI_PROBE_ONLY);

arch/x86/kernel/apic/io_apic.c

+5 −5
Original line number Diff line number Diff line
@@ -2316,12 +2316,12 @@ static int mp_irqdomain_create(int ioapic) 
	ip->irqdomain = irq_domain_create_linear(fn, hwirqs, cfg->ops,

						 (void *)(long)ioapic);



	if (!ip->irqdomain) {

		/* Release fw handle if it was allocated above */

		if (!cfg->dev)

			irq_domain_free_fwnode(fn);



	if (!ip->irqdomain)

		return -ENOMEM;

	}



	ip->irqdomain->parent = parent;

arch/x86/kernel/apic/msi.c

+12 −6
Original line number Diff line number Diff line
@@ -263,13 +263,14 @@ void __init arch_init_msi_domain(struct irq_domain *parent) 
		msi_default_domain =

			pci_msi_create_irq_domain(fn, &pci_msi_domain_info,

						  parent);

		irq_domain_free_fwnode(fn);

	}

	if (!msi_default_domain)

	if (!msi_default_domain) {

		irq_domain_free_fwnode(fn);

		pr_warn("failed to initialize irqdomain for MSI/MSI-x.\n");

	else

	} else {

		msi_default_domain->flags |= IRQ_DOMAIN_MSI_NOMASK_QUIRK;

	}

}



#ifdef CONFIG_IRQ_REMAP

static struct irq_chip pci_msi_ir_controller = {
@@ -301,6 +302,7 @@ struct irq_domain *arch_create_remap_msi_irq_domain(struct irq_domain *parent, 
	if (!fn)

		return NULL;

	d = pci_msi_create_irq_domain(fn, &pci_msi_ir_domain_info, parent);

	if (!d)

		irq_domain_free_fwnode(fn);

	return d;

}
@@ -364,6 +366,7 @@ static struct irq_domain *dmar_get_irq_domain(void) 
	if (fn) {

		dmar_domain = msi_create_irq_domain(fn, &dmar_msi_domain_info,

						    x86_vector_domain);

		if (!dmar_domain)

			irq_domain_free_fwnode(fn);

	}

out:
@@ -489,7 +492,10 @@ struct irq_domain *hpet_create_irq_domain(int hpet_id) 
	}



	d = msi_create_irq_domain(fn, domain_info, parent);

	if (!d) {

		irq_domain_free_fwnode(fn);

		kfree(domain_info);

	}

	return d;

}

arch/x86/kernel/apic/vector.c

+0 −1
Original line number Diff line number Diff line
@@ -709,7 +709,6 @@ int __init arch_early_irq_init(void) 
	x86_vector_domain = irq_domain_create_tree(fn, &x86_vector_domain_ops,

						   NULL);

	BUG_ON(x86_vector_domain == NULL);

	irq_domain_free_fwnode(fn);

	irq_set_default_host(x86_vector_domain);



	arch_init_msi_domain(x86_vector_domain);

arch/x86/platform/uv/uv_irq.c

+2 −1
Original line number Diff line number Diff line
@@ -167,9 +167,10 @@ static struct irq_domain *uv_get_irq_domain(void) 
		goto out;



	uv_domain = irq_domain_create_tree(fn, &uv_domain_ops, NULL);

	irq_domain_free_fwnode(fn);

	if (uv_domain)

		uv_domain->parent = x86_vector_domain;

	else

		irq_domain_free_fwnode(fn);

out:

	mutex_unlock(&uv_lock);

CRA Git | Maintained and supported by SUSTech CRA and CCSE