irqdomain: Fix disassociation race

commit f7fe3881bae1b1792c9f883bc6c158746e57e9c6 upstream.

The global irq_domain_mutex is held when mapping interrupts from
non-hierarchical domains but currently not when disposing them.

This specifically means that updates of the domain mapcount is racy
(currently only used for statistics in debugfs).

Make sure to hold the global irq_domain_mutex also when disposing
mappings from non-hierarchical domains.

Fixes: 36c12b6f14cc ("genirq/irqdomain: Add map counter")
Cc: stable@vger.kernel.org      # 4.13
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Tested-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230213104302.17307-3-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index f3d8d07ec168cff4b87601fc4b05a1e8a01566ef..3887882a9532305745eb1ba3789d8cb463e1df24 100644 (file)
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -538,6 +538,9 @@ static void irq_domain_disassociate(struct irq_domain *domain, unsigned int irq)
                return;
 
        hwirq = irq_data->hwirq;
+
+       mutex_lock(&irq_domain_mutex);
+
        irq_set_status_flags(irq, IRQ_NOREQUEST);
 
        /* remove chip and handler */
@@ -557,6 +560,8 @@ static void irq_domain_disassociate(struct irq_domain *domain, unsigned int irq)
 
        /* Clear reverse map for this hwirq */
        irq_domain_clear_mapping(domain, hwirq);
+
+       mutex_unlock(&irq_domain_mutex);
 }
 
 static int irq_domain_associate_locked(struct irq_domain *domain, unsigned int virq,