[PATCH] um: Add winch to winch_handlers before registering winch IRQ

[Roberto Sassu]

From: Roberto Sassu <roberto.sa...@huawei.com>

Registering a winch IRQ is racy, an interrupt may occur before the winch is
added to the winch_handlers list.

If that happens, register_winch_irq() adds to that list a winch that is
scheduled to be (or has already been) freed, causing a panic later in
winch_cleanup().

Avoid the race by adding the winch to the winch_handlers list before
registering the IRQ, and rolling back if um_request_irq() fails.

Signed-off-by: Roberto Sassu <roberto.sa...@huawei.com>
---
 arch/um/drivers/line.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index ffc5cb92fa36..d82bc3fdb86e 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -676,24 +676,26 @@ void register_winch_irq(int fd, int tty_fd, int pid, 
struct tty_port *port,
                goto cleanup;
        }
 
-       *winch = ((struct winch) { .list        = LIST_HEAD_INIT(winch->list),
-                                  .fd          = fd,
+       *winch = ((struct winch) { .fd          = fd,
                                   .tty_fd      = tty_fd,
                                   .pid         = pid,
                                   .port        = port,
                                   .stack       = stack });
 
+       spin_lock(&winch_handler_lock);
+       list_add(&winch->list, &winch_handlers);
+       spin_unlock(&winch_handler_lock);
+
        if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
                           IRQF_SHARED, "winch", winch) < 0) {
                printk(KERN_ERR "register_winch_irq - failed to register "
                       "IRQ\n");
+               spin_lock(&winch_handler_lock);
+               list_del(&winch->list);
+               spin_unlock(&winch_handler_lock);
                goto out_free;
        }
 
-       spin_lock(&winch_handler_lock);
-       list_add(&winch->list, &winch_handlers);
-       spin_unlock(&winch_handler_lock);
-
        return;
 
  out_free:
-- 
2.34.1