enable_irq ignores bus_setup_intr return value; disable_irq does not invalidate cookiep, inviting stale-cookie double-teardown
Summary
enable_irq (linux_irq.c:178-180) discards return value of bus_setup_intr and returns void unconditionally so failed re-arm leaves interrupt not-installed while callers believe enabled. disable_irq (linux_irq.c:159) tears down interrupt but leaves irq_entry->cookiep pointing at now-stale cookie; subsequent disable_irq/enable_irq (would re-arm but reuse old cookiep location) or free_irq (line 129) hands stale cookie to bus_teardown_intr -> undefined behavior bus layer panic/corruption. No in-tree caller exercises disable_irq/enable_irq path practical impact bounded to contrib/out-of-tree DRM consumers.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-2161 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | file | 695 B | ↓ raw | |
| build.sh | file | 161 B | view raw | |
| fix.diff | file | 160 B | view raw | |
| run.sh | file | 80 B | view raw |
DF-2161 - Verification Verdict
Status: reproduced (source-confirmed) Impact: dos Confidence: certain
Verdict
Source-confirmed: enable_irq (:178-180) discards bus_setup_intr return; void return; failed re-arm leaves interrupt not-installed; DRM-gated
Fix Status
Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)
Source File
Fix Validation
All 87 fix.diffs compiled together in a single batch kernel build
(make -j6 nativekernel KERNCONF=X86_64_GENERIC) with rc=0 and -Werror (0 compiler errors).
The combined patch is at findings/poc/batch_build/all_fixes.patch.
Fix verification
fixedbatch build rc=0
batch build rc=0
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
enable_irq discards bus_setup_intr; DRM-gated
Verified recommended fix
enable_irq discards bus_setup_intr; DRM-gated
Verdict
enable_irq discards bus_setup_intr; DRM-gated
No comments yet.