DF-5166
disable_irq/enable_irq resolve the victim entry by irq number only, ignoring dev_id β teardown/re-setup of the wrong device's handler whenever two registrations share or numerically collide on an irq
Summary
free_irq matches the (irq,dev_id) pair but disable/enable match irq only and take the SLIST head - on shared-INTx multi-GPU or duplicate registrations driver A silently tears down driver B's handler while its own stays armed. No in-tree callers on this shim today. Match-the-pair + lock fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5166 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5166
Confirmed kernel references
Detail
Evidence (decisive lines)
source trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (no DRM substrate on QEMU guest: request_irq cannot execute there; proven by line-level source trace)
No comments yet.