diff options
| author | WenTao Liang <vulab@iscas.ac.cn> | 2026-06-28 21:07:00 +0800 |
|---|---|---|
| committer | Daniel Lezcano <daniel.lezcano@kernel.org> | 2026-08-13 18:13:01 +0200 |
| commit | 05520e035f8332c8e33f3011b5ca016fde61793d (patch) | |
| tree | 026b00ef73535fab0706fb9cb1f4f89d17f78552 /drivers/clocksource/timer-probe.c | |
| parent | d21808328225ab8cee46885bf9a0dffcefbe630e (diff) | |
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path
When cpuhp_setup_state fails after pit_clockevent_per_cpu_init has
successfully called request_irq, the error handling jumps directly to
out_pit_clocksource_unregister without freeing the registered IRQ.
This leaks the IRQ line and, since kfree(pit) follows, leaves a
dangling pointer registered as the interrupt handler's dev_id,
potentially leading to a use-after-free if the IRQ fires afterwards.
Fix it by calling pit_clockevent_per_cpu_exit to properly release the
IRQ before falling through to the existing cleanup chain.
Suggested-by: Greg KH <gregkh@linuxfoundation.org>
Fixes: bee33f22d7c3 ("clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support")
Cc: stable@vger.kernel.org
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Link: https://patch.msgid.link/20260628130700.45680-1-vulab@iscas.ac.cn
Diffstat (limited to 'drivers/clocksource/timer-probe.c')
0 files changed, 0 insertions, 0 deletions
