From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtpbgau2.qq.com (smtpbgau2.qq.com [54.206.34.216]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA81B1D9663 for ; Mon, 27 Jul 2026 10:43:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=54.206.34.216 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785149030; cv=none; b=m2KizZTvi/lSxDhI1vJ/x2Gcq1xrY/t+vDv2jmq0is3PCUCtgu1rtWi1w6TuUhE9YTCFoUoGp+Ymx0BxbIzgVPacdCiUTLFliGTbhWKu9sXPnFOQ8MawWtnzA1xfzO8WUJ2XU/LCgnTsT9yJ2m8nN3k2l6Ec18hpC6GIDXvjg50= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785149030; c=relaxed/simple; bh=b9GnTfztri3/yW3axs2mNIumBQ5kyEumibsXpwMzwAI=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=dXaG+CUqnUnLmzC07WMUzYE2zizS1xyW673qOQfMqApuCoMh1ous+4UFTQ9uDOAoQ54Q89hvUVq7MHeQCmZDXqAs8eVZVbjXwRfHHFnmG3KE8gGF1FIoo0s65w/7S5pHpKg9Q72CrjbNMNWwtRIV1gyjeK1uj39D1xQ0dc9GGJg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=FWcnwO9C; arc=none smtp.client-ip=54.206.34.216 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="FWcnwO9C" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1785148966; bh=I/fnuTVnx7CMJPcZidDHjHGqG0uQuo9fgxe/9gGFCgY=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=FWcnwO9Cgs7OSqdAmyN6oywVNeuZI64kgNs4LzmkdlBhCv04bNhmNVilxouWsfJIQ CA3j4m64u6d3uIgzpfkyrP6NCZ5Jdr4okcx8zYE99XtEQW+EygPgzv+9AKLT1petD/ eGBw1gVcMLIdzS1bnINi6RXGCJKcVhein1V4zbws= X-QQ-mid: zesmtpip2t1785148954t6bc5e272 X-QQ-Originating-IP: DAiKkE6FqfAhF/JHeS/I6ndY6PFpfS8EXhFLIXWFDng= Received: from localhost.localdomain ( [localhost]) by bizesmtp.qq.com (ESMTP) with id ; Mon, 27 Jul 2026 18:42:31 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 1489267076884197094 EX-QQ-RecipientCnt: 21 From: Gou Hao To: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, chleroy@kernel.org, namcao@linutronix.de, peterz@infradead.org, sshegde@linux.ibm.com, kees@kernel.org, lgs201920130244@gmail.com, srikar@linux.ibm.com, ynorov@nvidia.com, nilay@linux.ibm.com, clg@kaod.org, benh@kernel.crashing.org, miltonm@bga.com, mkchauras@gmail.com, akpm@linux-foundation.org Cc: linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, gouhaojake@163.com, kernel@uniontech.com Subject: [PATCH v3 3/5] powerpc/xive: propagate IPI init errors to prevent use-after-free Date: Mon, 27 Jul 2026 18:42:13 +0800 Message-Id: <20260727104215.184786-4-gouhao@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260727104215.184786-1-gouhao@uniontech.com> References: <20260727104215.184786-1-gouhao@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-QQ-SENDSIZE: 520 Feedback-ID: zesmtpip:uniontech.com:qybglogicsvrgz:qybglogicsvrgz5b-2 X-QQ-XMAILINFO: MJ6pzQSz6S9mPeyuck42t9bql4EaE3+bYoodmIhgwwghVuFXFYzsj3n1 y+/coymgS4/VVd8T/alEdceADzIP6TzQyqbWoNPzbn11VE+5kNFKol3q+8lwl4aYKw7zXUm 38gXh5knSsqT6uZBys+uRclIafjVEm7UBq33PPMqTL8wZzBp04lY0+Kw02kS0wWpSDdfdp+ zuJKV4penXMb9MuyWbeXF3v1CaPuOpwyQIOF1o+TBEAochkZcNAApDjXxG6DThzH04BUiI7 XOHYiSgxCWJ9PJgnQ4waEcs8joLVVNcdVtRy/JZWaZYWwSzaMYpJlBhIBgCdLgv1jJ+gJH1 r/ZSKAM5W0jF+/eD6957TEgYBOp2v4LYxqtus9HzeU3rMQOKDZ/alflgO77RcTJecO3lt5b YmtWAHWs9yjlOYnVirBh/XTh8Q6z4NPPeULHyNyAf3BY2jcGWtgtdlqwR91aKAjH5LhBXxX b2CNMDHarBIPEpTCb1uD6aPB19N16iwrQOiCuN/VXdUnX0JGjj7Im7/Ak3ckDUcSd3LtxED 74Nbgvhxz48sp+9G6zY3usrjFqeXfmM2O1B+gGupaVME4mc1VZYSwOGgroNMB2tfXKykzKq 4f/oGCidNJ7QBDvaautU9qUjrN/2sf7nGOtCuGd9sfbO+oinAVjdANMTTDRDNA1ChVYxfZB zRJotuyDsAiecNOFXHlRxWijofcM7HFQtf8+JvXoFIFlH1HzzOGSRZcxXCyR/TS7bZ2SRVQ oUhjZLDyesrJHpX7VqIC09iUJ3QK09jD6+sPWqcCoD3+TlRdxDfqYFsYBPWtpNx/VY3DXx4 ZKZ99OdNWgaFGddYz+hARouSqHOuXTzUA+m0j66pumnk4MUiaUL4Vi+j9CiYk831W0WGG19 MOSd7yzsBIFo77gLHl/X5nNbyStKqQKvgrX23lHJ3OWxm+VLQs+qgi3DC5Aw+dbn3oJrWK2 5Ua/Dd6cLt6N5pzvWqjS5qlm9jG7ZyBJQ5hxRMKZfvvBvovqjFoNAX7CTXvOHfmNyW7xO2j wOMWnYuN83u3ukyoPYOPTOk6tn7pzSK3+YD2eMWBeqocxaHWxBJjhn+77znjwBIiTcP2C4f heEkFKoOBjmcKdb5yy/LJA= X-QQ-XMRINFO: MPJ6Tf5t3I/ylTmHUqvI8+Wpn+Gzalws3A== X-QQ-RECHKSPAM: 0 When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free. Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free. Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller") Fixes: cbc06f051c52 ("powerpc/xive: Do not skip CPU-less nodes when creating the IPIs") Signed-off-by: Gou Hao Reviewed-by: Wentao Guan Reviewed-by: jiazhenyuan --- arch/powerpc/platforms/powernv/smp.c | 8 +++++--- arch/powerpc/platforms/pseries/smp.c | 8 +++++--- arch/powerpc/sysdev/xive/common.c | 10 ++++++---- 3 files changed, 16 insertions(+), 10 deletions(-) diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c index 8f41ef364fc6..b1201dbafcaf 100644 --- a/arch/powerpc/platforms/powernv/smp.c +++ b/arch/powerpc/platforms/powernv/smp.c @@ -332,10 +332,12 @@ static void pnv_cause_ipi(int cpu) static void __init pnv_smp_probe(void) { - if (xive_enabled()) - xive_smp_probe(); - else + if (xive_enabled()) { + if (xive_smp_probe() < 0) + return; + } else { xics_smp_probe(); + } if (cpu_has_feature(CPU_FTR_DBELL)) { ic_cause_ipi = smp_ops->cause_ipi; diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c index db99725e752b..14cd0634eeca 100644 --- a/arch/powerpc/platforms/pseries/smp.c +++ b/arch/powerpc/platforms/pseries/smp.c @@ -194,10 +194,12 @@ static int pseries_cause_nmi_ipi(int cpu) static __init void pSeries_smp_probe(void) { - if (xive_enabled()) - xive_smp_probe(); - else + if (xive_enabled()) { + if (xive_smp_probe() < 0) + return; + } else { xics_smp_probe(); + } /* No doorbell facility, must use the interrupt controller for IPIs */ if (!cpu_has_feature(CPU_FTR_DBELL)) diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c index 9f80c16be23f..bbe7c85274ea 100644 --- a/arch/powerpc/sysdev/xive/common.c +++ b/arch/powerpc/sysdev/xive/common.c @@ -1267,15 +1267,17 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc) int __init xive_smp_probe(void) { + int ret; + smp_ops->cause_ipi = xive_cause_ipi; /* Register the IPI */ - xive_init_ipis(); + ret = xive_init_ipis(); + if (ret < 0) + return ret; /* Allocate and setup IPI for the boot CPU */ - xive_setup_cpu_ipi(smp_processor_id()); - - return 0; + return xive_setup_cpu_ipi(smp_processor_id()); } #endif /* CONFIG_SMP */ -- 2.20.1