gpio: mxc: fix race between chained IRQ handler install and probe completion
Impact
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b to before 261802c14e1a3281987ea8f106701e5ed9652f68 | affected |
| 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b to before 6c1e035d881579a6e4ed1ce5feabb13d23e80a82 | affected |
| 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b to before 38d44f78f041ffe60c8e2443b99434a199e7541d | affected |
Linux · Linux
Other versions: affected
| Version / range | Source status |
|---|---|
| 6.6 | affected |
| 0 to before 6.6 | unaffected |
| 6.18.59 through 6.18.* (inclusive) | unaffected |
| 7.2.13 through 7.2.* (inclusive) | unaffected |
| 7.3 through * (inclusive) | unaffected |
Original source description
In the Linux kernel, the following vulnerability has been resolved:
gpio: mxc: fix race between chained IRQ handler install and probe completion
mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that window:
- mx3_gpio_irq_handler() calls generic_handle_domain_irq() with port->domain still NULL.
- mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not been added to the list yet.
Additionally, if any of the subsequent probe steps (gpio_generic_chip_init(), devm_gpiochip_add_data(), irq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error paths never unregister the chained handler, leaving a dangling handler that points at freed memory.
Move the handler installation after all its dependencies are ready and after list_add_tail(), so the handler is never live while the data structures it touches are incomplete, and is never installed if probe fails.