)]}'
{
  "commit": "20ddfdd45db0dfc1193c8c81cb20196befbf0743",
  "tree": "9b3336a9142e118971e302a83cf2b6ca7d42f55f",
  "parents": [
    "306afdf4e512bf760994face0363fc054ce05dc8"
  ],
  "author": {
    "name": "Thomas Gleixner",
    "email": "tglx@linutronix.de",
    "time": "Thu Dec 11 23:01:41 2014 +0100"
  },
  "committer": {
    "name": "William Bellavance",
    "email": "flintman@flintmancomputers.com",
    "time": "Wed Feb 10 20:00:11 2016 -0500"
  },
  "message": "genirq: Prevent proc race against freeing of irq descriptors\n\ncommit c291ee622165cb2c8d4e7af63fffd499354a23be upstream.\n\nSince the rework of the sparse interrupt code to actually free the\nunused interrupt descriptors there exists a race between the /proc\ninterfaces to the irq subsystem and the code which frees the interrupt\ndescriptor.\n\nCPU0\t\t\t\tCPU1\n\t\t\t\tshow_interrupts()\n\t\t\t\t  desc \u003d irq_to_desc(X);\nfree_desc(desc)\n  remove_from_radix_tree();\n  kfree(desc);\n\t\t\t\t  raw_spinlock_irq(\u0026desc-\u003elock);\n\n/proc/interrupts is the only interface which can actively corrupt\nkernel memory via the lock access. /proc/stat can only read from freed\nmemory. Extremly hard to trigger, but possible.\n\nThe interfaces in /proc/irq/N/ are not affected by this because the\nremoval of the proc file is serialized in procfs against concurrent\nreaders/writers. The removal happens before the descriptor is freed.\n\nFor architectures which have CONFIG_SPARSE_IRQ\u003dn this is a non issue\nas the descriptor is never freed. It\u0027s merely cleared out with the irq\ndescriptor lock held. So any concurrent proc access will either see\nthe old correct value or the cleared out ones.\n\nProtect the lookup and access to the irq descriptor in\nshow_interrupts() with the sparse_irq_lock.\n\nProvide kstat_irqs_usr() which is protecting the lookup and access\nwith sparse_irq_lock and switch /proc/stat to use it.\n\nDocument the existing kstat_irqs interfaces so it\u0027s clear that the\ncaller needs to take care about protection. The users of these\ninterfaces are either not affected due to SPARSE_IRQ\u003dn or already\nprotected against removal.\n\nFixes: 1f5a5b87f78f \"genirq: Implement a sane sparse_irq allocator\"\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n[lizf: Backported to 3.4:\n - define kstat_irqs() for CONFIG_GENERIC_HARDIRQS\n - add ifdef/endif CONFIG_SPARSE_IRQ]\nSigned-off-by: Zefan Li \u003clizefan@huawei.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a1ca9bcf862f3f84b9b697a1b71eb0a3715e8437",
      "old_mode": 33188,
      "old_path": "fs/proc/stat.c",
      "new_id": "95f2e25690f5d335a993f02a9efdc53402555014",
      "new_mode": 33188,
      "new_path": "fs/proc/stat.c"
    },
    {
      "type": "modify",
      "old_id": "2fbd9053c2df6477a425567c49014ea3328f9038",
      "old_mode": 33188,
      "old_path": "include/linux/kernel_stat.h",
      "new_id": "8e62498eeab3424e6f16d8c96a8e0fdada76ae4a",
      "new_mode": 33188,
      "new_path": "include/linux/kernel_stat.h"
    },
    {
      "type": "modify",
      "old_id": "8e5c56b3b7d9c5f70c49d48f7082636b1b3bdf89",
      "old_mode": 33188,
      "old_path": "kernel/irq/internals.h",
      "new_id": "5a414405deef50092fb2ee028ca636ec053d35c4",
      "new_mode": 33188,
      "new_path": "kernel/irq/internals.h"
    },
    {
      "type": "modify",
      "old_id": "8ab8e9390297a06ef7c4efc2a8ad502433b13879",
      "old_mode": 33188,
      "old_path": "kernel/irq/irqdesc.c",
      "new_id": "07d45516b5404d24a4c8c1228dedf54d8811a907",
      "new_mode": 33188,
      "new_path": "kernel/irq/irqdesc.c"
    },
    {
      "type": "modify",
      "old_id": "4108ef48af942504bca50006e86c2c5e1c204aff",
      "old_mode": 33188,
      "old_path": "kernel/irq/proc.c",
      "new_id": "c0a70fca15a4e7b90db019301150eca005d89943",
      "new_mode": 33188,
      "new_path": "kernel/irq/proc.c"
    }
  ]
}