github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ata: libahci: Free the IRQs when activating a multi-IRQ host fails

Browse Source 
ahci_host_activate_multi_irqs() requests one IRQ per port, but it does
not free them when requesting one of them, or when registering the host,
fails. The IRQs are only freed by the driver core, when it releases the
devres of the device after probe() has returned, while the caller of
ahci_host_activate() releases the resources of the host in its probe()
error path, e.g. ahci_probe() disables the clocks, regulators, resets and
PHYs of the host. An IRQ handler running in that window would access the
MMIO of a host which is no longer clocked.

ahci_host_activate_multi_irqs() did free the IRQs until commit
0a142b2692 ("ahci: cleanup ahci_host_activate_multi_irqs"), which
removed the explicit free because devm makes it unnecessary. That is true
for freeing the IRQs as such, but not for the window described above:
devres is only released after probe() has returned, i.e. after the error
path of the caller has released the resources of the host.

Note that this window cannot be hit with the current users: the only user
of AHCI_HFLAG_MULTI_MSI is the AHCI PCI driver, which does not release
any resource in its probe() error path, and the ports of the host are
still frozen, i.e. their interrupts are masked, when ata_host_register()
fails.

Free the IRQs explicitly again, like ata_host_activate() does, so that
the IRQ handlers cannot run once ahci_host_activate() has failed.

Fixes: 0a142b2692 ("ahci: cleanup ahci_host_activate_multi_irqs")
Cc: stable@vger.kernel.org
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Link: https://lore.kernel.org/r/20260915084127.692494-12-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
This commit is contained in:
Niklas Cassel 2026-09-15 10:41:30 +02:00
parent 70b1196740
commit 34a4a34431
1 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
drivers/ata/libahci.c
View File

@ -2724,11 +2724,33 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
0, pp->irq_desc, host->ports[i]);
if (rc)
return rc;
goto free_irqs;
ata_port_desc_misc(host->ports[i], irq);
}
return ata_host_register(host, sht);
rc = ata_host_register(host, sht);
if (rc)
goto free_irqs;
return 0;
free_irqs:
/*
* Free the IRQs which have been requested, so that the handlers can no
* longer access the MMIO of the host once we return, e.g. after the
* caller has disabled the clocks of the host.
*/
while (--i >= 0) {
struct ahci_port_priv *pp = host->ports[i]->private_data;
if (!pp)
continue;
devm_free_irq(host->dev, hpriv->get_irq_vector(host, i),
host->ports[i]);
}
return rc;
}
/**