Commit b7d14361 authored by Vincent Whitchurch's avatar Vincent Whitchurch Committed by Gu Bowen
Browse files

tty: goldfish: Fix free_irq() on remove 

stable inclusion
from stable-v4.19.249
commit c83a1d40dc624070a203eb383ef9fb60eb634136
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP33Y
CVE: CVE-2022-49724

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c83a1d40dc624070a203eb383ef9fb60eb634136



--------------------------------

[ Upstream commit 499e13aa ]

Pass the correct dev_id to free_irq() to fix this splat when the driver
is unbound:

 WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq
 Trying to free already-free IRQ 65
 Call Trace:
  warn_slowpath_fmt
  free_irq
  goldfish_tty_remove
  platform_remove
  device_remove
  device_release_driver_internal
  device_driver_detach
  unbind_store
  drv_attr_store
  ...

Fixes: 465893e1 ("tty: goldfish: support platform_device with id -1")
Signed-off-by: default avatarVincent Whitchurch <vincent.whitchurch@axis.com>
Link: https://lore.kernel.org/r/20220609141704.1080024-1-vincent.whitchurch@axis.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Conflicts:
	drivers/tty/goldfish.c
[Context conflicts.]
Signed-off-by: default avatarGu Bowen <gubowen5@huawei.com>
parent afadf562

drivers/tty/goldfish.c

+1 −1
Original line number Diff line number Diff line
@@ -427,7 +427,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) 
	tty_unregister_device(goldfish_tty_driver, qtty->console.index);

	iounmap(qtty->base);

	qtty->base = NULL;

	free_irq(qtty->irq, pdev);

	free_irq(qtty->irq, qtty);

	goldfish_tty_current_line_count--;

	if (goldfish_tty_current_line_count == 0)

		goldfish_tty_delete_driver();