s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit()
authorJulian Ruess <julianr@linux.ibm.com>
Tue, 13 Jun 2023 12:25:37 +0000 (14:25 +0200)
committerDavid S. Miller <davem@davemloft.net>
Thu, 15 Jun 2023 07:48:45 +0000 (08:48 +0100)
commit78d0f94902afce8ec2c7a60f600cc0e3729d7412
treea07624fca54c5ab1a970af0c5f54bf7ef73669fc
parent6ac7a27a8b07588497ed53dfd885df9c72bc67e0
s390/ism: Fix trying to free already-freed IRQ by repeated ism_dev_exit()

This patch prevents the system from crashing when unloading the ISM module.

How to reproduce: Attach an ISM device and execute 'rmmod ism'.

Error-Log:
- Trying to free already-free IRQ 0
- WARNING: CPU: 1 PID: 966 at kernel/irq/manage.c:1890 free_irq+0x140/0x540

After calling ism_dev_exit() for each ISM device in the exit routine,
pci_unregister_driver() will execute ism_remove() for each ISM device.
Because ism_remove() also calls ism_dev_exit(),
free_irq(pci_irq_vector(pdev, 0), ism) is called twice for each ISM
device. This results in a crash with the error
'Trying to free already-free IRQ'.

In the exit routine, it is enough to call pci_unregister_driver()
because it ensures that ism_dev_exit() is called once per
ISM device.

Cc: <stable@vger.kernel.org> # 6.3+
Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration")
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Julian Ruess <julianr@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/s390/net/ism_drv.c