This is a note to let you know that I've just added the patch titled
s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit()
to the 6.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
s390-ism-fix-trying-to-free-already-freed-irq-by-repeated-ism_dev_exit.patch
and it can be found in the queue-6.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 78d0f94902afce8ec2c7a60f600cc0e3729d7412 Mon Sep 17 00:00:00 2001
From: Julian Ruess <julianr@xxxxxxxxxxxxx>
Date: Tue, 13 Jun 2023 14:25:37 +0200
Subject: s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit()
From: Julian Ruess <julianr@xxxxxxxxxxxxx>
commit 78d0f94902afce8ec2c7a60f600cc0e3729d7412 upstream.
This patch prevents the system from crashing when unloading the ISM module.
How to reproduce: Attach an ISM device and execute 'rmmod ism'.
Error-Log:
- Trying to free already-free IRQ 0
- WARNING: CPU: 1 PID: 966 at kernel/irq/manage.c:1890 free_irq+0x140/0x540
After calling ism_dev_exit() for each ISM device in the exit routine,
pci_unregister_driver() will execute ism_remove() for each ISM device.
Because ism_remove() also calls ism_dev_exit(),
free_irq(pci_irq_vector(pdev, 0), ism) is called twice for each ISM
device. This results in a crash with the error
'Trying to free already-free IRQ'.
In the exit routine, it is enough to call pci_unregister_driver()
because it ensures that ism_dev_exit() is called once per
ISM device.
Cc: <stable@xxxxxxxxxxxxxxx> # 6.3+
Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration")
Reviewed-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx>
Signed-off-by: Julian Ruess <julianr@xxxxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/s390/net/ism_drv.c | 8 --------
1 file changed, 8 deletions(-)
--- a/drivers/s390/net/ism_drv.c
+++ b/drivers/s390/net/ism_drv.c
@@ -774,14 +774,6 @@ static int __init ism_init(void)
static void __exit ism_exit(void)
{
- struct ism_dev *ism;
-
- mutex_lock(&ism_dev_list.mutex);
- list_for_each_entry(ism, &ism_dev_list.list, list) {
- ism_dev_exit(ism);
- }
- mutex_unlock(&ism_dev_list.mutex);
-
pci_unregister_driver(&ism_driver);
debug_unregister(ism_debug_info);
}
Patches currently in stable-queue which might be from julianr@xxxxxxxxxxxxx are
queue-6.3/s390-ism-fix-trying-to-free-already-freed-irq-by-repeated-ism_dev_exit.patch
