Thomas Gleixner 5666a3de7a genirq: Prevent proc race against freeing of irq descriptors ... commit c291ee6221 upstream. Since the rework of the sparse interrupt code to actually free the unused interrupt descriptors there exists a race between the /proc interfaces to the irq subsystem and the code which frees the interrupt descriptor. CPU0 CPU1 show_interrupts() desc = irq_to_desc(X); free_desc(desc) remove_from_radix_tree(); kfree(desc); raw_spinlock_irq(&desc->lock); /proc/interrupts is the only interface which can actively corrupt kernel memory via the lock access. /proc/stat can only read from freed memory. Extremly hard to trigger, but possible. The interfaces in /proc/irq/N/ are not affected by this because the removal of the proc file is serialized in procfs against concurrent readers/writers. The removal happens before the descriptor is freed. For architectures which have CONFIG_SPARSE_IRQ=n this is a non issue as the descriptor is never freed. It's merely cleared out with the irq descriptor lock held. So any concurrent proc access will either see the old correct value or the cleared out ones. Protect the lookup and access to the irq descriptor in show_interrupts() with the sparse_irq_lock. Provide kstat_irqs_usr() which is protecting the lookup and access with sparse_irq_lock and switch /proc/stat to use it. Document the existing kstat_irqs interfaces so it's clear that the caller needs to take care about protection. The users of these interfaces are either not affected due to SPARSE_IRQ=n or already protected against removal. Fixes: 1f5a5b87f7 "genirq: Implement a sane sparse_irq allocator" Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2015-01-27 08:18:55 -08:00
..
acpi
asm-generic
clocksource
crypto
drm	drm/radeon: remove invalid pci id	2014-11-14 09:00:12 -08:00
dt-bindings	pinctrl: dra: dt-bindings: Fix output pull up/down	2014-11-21 09:23:02 -08:00
keys
kvm
linux	genirq: Prevent proc race against freeing of irq descriptors	2015-01-27 08:18:55 -08:00
math-emu
media	media: vb2: fix VBI/poll regression	2014-10-09 12:21:27 -07:00
memory
misc
net	net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks	2014-11-21 09:23:06 -08:00
pcmcia
ras
rdma
rxrpc
scsi
sound	ASoC: dpcm: Fix race between FE/BE updates and trigger	2014-12-06 15:55:35 -08:00
target
trace	tracing/sched: Check preempt_count() for current when reading task->state	2015-01-16 06:59:32 -08:00
uapi	in6: fix conflict with glibc	2015-01-27 08:18:53 -08:00
video
xen
Kbuild