OHCI driver grabs IRQ too early.
Brought to you by:
aeb,
bencollins
From: Daniel K. <dan...@st...> - 2000-05-13 16:28:32
|
Hi Sebastien! The OHCI irq handler uses reg_read() to determine whether it has to service an interrupt. reg_read() in turn relies on ohci->registers containing the controllers remapped MMIO space. add_card() however requests the irq long before the ioremap(), thus leaving a window open where we might access bogus memory locations. The race should only occur if the irq line is shared with other devices. Patch below that moves request_irq() to the very end of add_card(). Regards, Daniel. --[snip]-- Index: ohci1394.c =================================================================== RCS file: /cvsroot/linux1394/ieee1394/ohci1394.c,v retrieving revision 1.28 diff -u -r1.28 ohci1394.c --- ohci1394.c 2000/05/12 02:16:07 1.28 +++ ohci1394.c 2000/05/13 16:09:14 @@ -2185,13 +2185,6 @@ ohci->state = 0; - if (!request_irq(dev->irq, ohci_irq_handler, SA_SHIRQ, - OHCI1394_DRIVER_NAME, ohci)) { - PRINT(KERN_INFO, ohci->id, "allocated interrupt %d", dev->irq); - } else { - FAIL("failed to allocate shared interrupt %d", dev->irq); - } - /* csr_config rom allocation */ ohci->csr_config_rom = kmalloc(1024, GFP_KERNEL); if (ohci->csr_config_rom == NULL) { @@ -2269,6 +2262,13 @@ PRINT(KERN_INFO, ohci->id, "remapped memory spaces reg 0x%p", ohci->registers); + + if (!request_irq(dev->irq, ohci_irq_handler, SA_SHIRQ, + OHCI1394_DRIVER_NAME, ohci)) { + PRINT(KERN_INFO, ohci->id, "allocated interrupt %d", dev->irq); + } else { + FAIL("failed to allocate shared interrupt %d", dev->irq); + } return 0; #undef FAIL |