[PATCH] misc: rp1: clear chained IRQ handlers on teardown

[PATCH] misc: rp1: clear chained IRQ handlers on teardown

[Pengpeng Hou]

rp1_probe() installs a chained handler for each parent MSI-X vector and
stores the rp1 device pointer as handler data. rp1_unregister_interrupts()
then disposes the child IRQ mappings, removes the IRQ domain, and frees
the PCI IRQ vectors without first removing those chained handlers.

If a teardown path runs after the handlers have been installed, a later
parent IRQ can still call rp1_chained_handle_irq() with stale handler
data and a removed IRQ domain. Clear the chained handlers before
disposing mappings and freeing the vectors.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/misc/rp1/rp1_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/misc/rp1/rp1_pci.c b/drivers/misc/rp1/rp1_pci.c
index 81685e3f3296..a1f20d88be5d 100644
--- a/drivers/misc/rp1/rp1_pci.c
+++ b/drivers/misc/rp1/rp1_pci.c
@@ -166,6 +166,9 @@ static void rp1_unregister_interrupts(struct pci_dev *pdev)
 	struct rp1_dev *rp1 = pci_get_drvdata(pdev);
 	int irq, i;
 
+	for (i = 0; i < RP1_INT_END; i++)
+		irq_set_chained_handler_and_data(pci_irq_vector(pdev, i), NULL, NULL);
+
 	if (rp1->domain) {
 		for (i = 0; i < RP1_INT_END; i++) {
 			irq = irq_find_mapping(rp1->domain, i);
-- 
2.43.0

Re: [PATCH] misc: rp1: clear chained IRQ handlers on teardown

[Andrea della Porta]

Hi,

On 23:10 Tue 16 Jun     , Pengpeng Hou wrote:
> rp1_probe() installs a chained handler for each parent MSI-X vector and
> stores the rp1 device pointer as handler data. rp1_unregister_interrupts()
> then disposes the child IRQ mappings, removes the IRQ domain, and frees
> the PCI IRQ vectors without first removing those chained handlers.
> 
> If a teardown path runs after the handlers have been installed, a later
> parent IRQ can still call rp1_chained_handle_irq() with stale handler
> data and a removed IRQ domain. Clear the chained handlers before
> disposing mappings and freeing the vectors.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/misc/rp1/rp1_pci.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/misc/rp1/rp1_pci.c b/drivers/misc/rp1/rp1_pci.c
> index 81685e3f3296..a1f20d88be5d 100644
> --- a/drivers/misc/rp1/rp1_pci.c
> +++ b/drivers/misc/rp1/rp1_pci.c
> @@ -166,6 +166,9 @@ static void rp1_unregister_interrupts(struct pci_dev *pdev)
>  	struct rp1_dev *rp1 = pci_get_drvdata(pdev);
>  	int irq, i;
>  
> +	for (i = 0; i < RP1_INT_END; i++)
> +		irq_set_chained_handler_and_data(pci_irq_vector(pdev, i), NULL, NULL);
> +
>  	if (rp1->domain) {
>  		for (i = 0; i < RP1_INT_END; i++) {
>  			irq = irq_find_mapping(rp1->domain, i);
> -- 
> 2.43.0
>

Reviewed-by: Andrea della Porta <andrea.porta@suse.com>