From e5567cfc74c2ff84e4894b1b9b2953a08e40207f Mon Sep 17 00:00:00 2001 From: Alex Zenla Date: Fri, 22 Nov 2024 06:51:00 +0800 Subject: [PATCH] 9p/xen: fix release of IRQ ANBZ: #13478 commit e43c608f40c065b30964f0a806348062991b802d upstream. Kernel logs indicate an IRQ was double-freed. Pass correct device ID during IRQ release. Fixes: 71ebd71921e45 ("xen/9pfs: connect to the backend") Signed-off-by: Alex Zenla Signed-off-by: Alexander Merritt Signed-off-by: Ariadne Conill Reviewed-by: Juergen Gross Message-ID: <20241121225100.5736-1-alexander@edera.dev> [Dominique: remove confusing variable reset to 0] Signed-off-by: Dominique Martinet Fixes: CVE-2024-56704 Signed-off-by: Xiao Long Signed-off-by: Philo Lu --- net/9p/trans_xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 7e27f733869b..e11663b60335 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -298,7 +298,7 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0) - unbind_from_irqhandler(priv->rings[i].irq, priv->dev); + unbind_from_irqhandler(priv->rings[i].irq, ring); if (priv->rings[i].data.in) { for (j = 0; j < (1 << priv->rings[i].intf->ring_order); -- Gitee