OHCI driver grabs IRQ too early.

[Daniel K. <dan...@st...>]

Hi Sebastien!

The OHCI irq handler uses reg_read() to determine whether it has to
service an interrupt. reg_read() in turn relies on
ohci->registers containing the controllers remapped MMIO
space. add_card() however requests the irq long before the ioremap(), thus
leaving a window open where we might access bogus memory locations. The
race should only occur if the irq line is shared with other devices. Patch
below that moves request_irq() to the very end of add_card().

Regards,

Daniel.

--[snip]--

Index: ohci1394.c
===================================================================
RCS file: /cvsroot/linux1394/ieee1394/ohci1394.c,v
retrieving revision 1.28
diff -u -r1.28 ohci1394.c
--- ohci1394.c	2000/05/12 02:16:07	1.28
+++ ohci1394.c	2000/05/13 16:09:14
@@ -2185,13 +2185,6 @@
 	
 	ohci->state = 0;
 
-	if (!request_irq(dev->irq, ohci_irq_handler, SA_SHIRQ,
-			 OHCI1394_DRIVER_NAME, ohci)) {
-		PRINT(KERN_INFO, ohci->id, "allocated interrupt %d", dev->irq);
-	} else {
-		FAIL("failed to allocate shared interrupt %d", dev->irq);
-	}
-
 	/* csr_config rom allocation */
 	ohci->csr_config_rom = kmalloc(1024, GFP_KERNEL);
 	if (ohci->csr_config_rom == NULL) {
@@ -2269,6 +2262,13 @@
 
 	PRINT(KERN_INFO, ohci->id, "remapped memory spaces reg 0x%p",
 	      ohci->registers);
+
+	if (!request_irq(dev->irq, ohci_irq_handler, SA_SHIRQ,
+			 OHCI1394_DRIVER_NAME, ohci)) {
+		PRINT(KERN_INFO, ohci->id, "allocated interrupt %d", dev->irq);
+	} else {
+		FAIL("failed to allocate shared interrupt %d", dev->irq);
+	}
 
 	return 0;
 #undef FAIL