mirror of
https://github.com/torvalds/linux.git
synced 2026-09-20 09:40:02 +02:00
5a9c554ff8
qtnf_pcie_topaz_probe() currently calls devm_request_irq() and only then disable_irq(). request_irq() installs the action in the irq core immediately, so qtnf_pcie_topaz_interrupt() can run before the Topaz private IRQ consumers are initialized, if the hardware misbehaves. This window is reachable on a running system as soon as probe has successfully registered pdev->irq but before qtnf_pcie_init_shm_ipc() sets shm_ipc_ep_in/out.irq_handler. If an interrupt is delivered in this interval, qtnf_pcie_topaz_interrupt() calls qtnf_shm_ipc_irq_handler() for shm_ipc_ep_in/out while their irq_handler callbacks are still unset, so the driver can observe an early IRQ before its IPC consumer state is ready. The issue was found on Linux v6.18.21 by our static analysis tool while scanning request_irq()/disable_irq() registration-order bugs in wireless PCIe drivers, and then manually reviewed. Request the IRQ with IRQF_NO_AUTOEN instead and keep the existing enable_irq() in qtnf_post_init_ep() as the point where interrupts become visible. This closes the early-IRQ window while preserving the intended bring-up order. Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn> Link: https://patch.msgid.link/20260531145435.701703-1-runyu.xiao@seu.edu.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
||
|---|---|---|
| .. | ||
| pcie | ||
| bus.h | ||
| cfg80211.c | ||
| cfg80211.h | ||
| commands.c | ||
| commands.h | ||
| core.c | ||
| core.h | ||
| debug.c | ||
| debug.h | ||
| event.c | ||
| event.h | ||
| Kconfig | ||
| Makefile | ||
| qlink_util.c | ||
| qlink_util.h | ||
| qlink.h | ||
| qtn_hw_ids.h | ||
| shm_ipc_defs.h | ||
| shm_ipc.c | ||
| shm_ipc.h | ||
| switchdev.h | ||
| trans.c | ||
| trans.h | ||
| util.c | ||
| util.h | ||