EDAC: fsl_ddr: probe failure and remove lifetime fixes

[PATCH 0/2] EDAC: fsl_ddr: probe failure and remove lifetime fixes

Rosen Penev posted 2 patches 5 days, 7 hours ago

Download series mbox

drivers/edac/fsl_ddr_edac.c | 42 +++++++++++++++++++++++--------------
1 file changed, 26 insertions(+), 16 deletions(-)

Expand all Fold all

[PATCH 0/2] EDAC: fsl_ddr: probe failure and remove lifetime fixes

Posted by Rosen Penev 5 days, 7 hours ago

This series fixes two lifetime/error-path issues in the FSL DDR EDAC
driver (drivers/edac/fsl_ddr_edac.c):

* Patch 1: On probe failure, fsl_mc_err_probe() leaves the memory
  controller hardware configured to generate interrupts (DISABLE cleared,
  INT_EN set) while no handler is registered, which can trigger an
  unhandled interrupt storm on the shared IRQ line. Restore the MC error
  registers in both error paths.

* Patch 2: The devm-requested IRQ passes mci as context, but
  fsl_mc_err_remove() frees mci via edac_mc_free() before devres tears
  down the IRQ, leaving a use-after-free window for the shared interrupt
  handler. Manage mci lifetime through devres so it is freed only after
  the IRQ is released.

Both patches are build-tested for arm64 (defconfig + CONFIG_EDAC_FSL_DDR)
with LLVM=1.

Rosen Penev (2):
  EDAC: fsl_ddr: restore MC error registers on probe failure
  EDAC: fsl_ddr: manage mci lifetime via devres to fix remove UAF

 drivers/edac/fsl_ddr_edac.c | 42 +++++++++++++++++++++++--------------
 1 file changed, 26 insertions(+), 16 deletions(-)

-- 
2.55.0