From: Alex Zenla alex@edera.dev
stable inclusion from stable-v5.10.231 commit 7f5a2ed5c1810661e6b03f5a4ebf17682cdea850 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDPA CVE: CVE-2024-56704
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
[ Upstream commit e43c608f40c065b30964f0a806348062991b802d ]
Kernel logs indicate an IRQ was double-freed.
Pass correct device ID during IRQ release.
Fixes: 71ebd71921e45 ("xen/9pfs: connect to the backend") Signed-off-by: Alex Zenla alex@edera.dev Signed-off-by: Alexander Merritt alexander@edera.dev Signed-off-by: Ariadne Conill ariadne@ariadne.space Reviewed-by: Juergen Gross jgross@suse.com Message-ID: 20241121225100.5736-1-alexander@edera.dev [Dominique: remove confusing variable reset to 0] Signed-off-by: Dominique Martinet asmadeus@codewreck.org Signed-off-by: Sasha Levin sashal@kernel.org (cherry picked from commit 7f5a2ed5c1810661e6b03f5a4ebf17682cdea850) Signed-off-by: Ze Zuo zuoze1@huawei.com --- net/9p/trans_xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index da056170849b..69902198df55 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -307,7 +307,7 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0) - unbind_from_irqhandler(priv->rings[i].irq, priv->dev); + unbind_from_irqhandler(priv->rings[i].irq, ring); if (priv->rings[i].data.in) { for (j = 0; j < (1 << priv->rings[i].intf->ring_order);