diff options
| author | WenTao Liang <vulab@iscas.ac.cn> | 2026-06-28 21:07:00 +0800 |
|---|---|---|
| committer | Daniel Lezcano <daniel.lezcano@kernel.org> | 2026-08-11 14:14:19 +0200 |
| commit | b839fe55d4d36a9401f7351f525cc8c4533883c2 (patch) | |
| tree | 026b00ef73535fab0706fb9cb1f4f89d17f78552 /scripts/objdiff | |
| parent | 97988070f67b8c7e600eae0691c15a970d9e5a7a (diff) | |
| download | linux-next-b839fe55d4d36a9401f7351f525cc8c4533883c2.tar.gz linux-next-b839fe55d4d36a9401f7351f525cc8c4533883c2.zip | |
clocksource/nxp-pit: Dix IRQ leak on cpuhp_setup_state error path
When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has
successfully called request_irq, the error handling jumps directly to
out_pit_clocksource_unregister without freeing the registered IRQ.
This leaks the IRQ line and, since kfree(pit) follows, leaves a
dangling pointer registered as the interrupt handler's dev_id,
potentially leading to a use-after-free if the IRQ fires afterwards.
Fix it by calling pit_clockevent_per_cpu_exit to properly release the
IRQ before falling through to the existing cleanup chain.
Suggested-by: Greg KH <gregkh@linuxfoundation.org>
Fixes: bee33f22d7c3 ("clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support")
Cc: stable@vger.kernel.org
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260628130700.45680-1-vulab@iscas.ac.cn
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions
