[PATCH] irqchip/riscv-imsic: Fix MMIO regset lookup loop bound

[PATCH] irqchip/riscv-imsic: Fix MMIO regset lookup loop bound

[GUO Ren (XuanTie)]

The nr_mmios is the number of entries in the MMIO resource array, while
j is the index used to iterate over the array. Testing nr_mmios directly
makes the loop condition permanently true whenever at least one MMIO
region exists.

So, change
  for (j = 0; nr_mmios; j++) {
to
  for (j = 0; j < nr_mmios; j++) {

Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
Cc: stable@vger.kernel.org
Signed-off-by: GUO Ren (XuanTie) <guoren@kernel.org>
---
This patch fixes an out-of-bounds access in the RISC-V IMSIC MMIO
resource lookup.
---
 drivers/irqchip/irq-riscv-imsic-state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
index b8d1bbbf42f7..008dfcf343e5 100644
--- a/drivers/irqchip/irq-riscv-imsic-state.c
+++ b/drivers/irqchip/irq-riscv-imsic-state.c
@@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
 		index = nr_mmios;
 		reloff = i * BIT(global->guest_index_bits) *
 			 IMSIC_MMIO_PAGE_SZ;
-		for (j = 0; nr_mmios; j++) {
+		for (j = 0; j < nr_mmios; j++) {
 			if (reloff < resource_size(&mmios[j])) {
 				index = j;
 				break;

---
base-commit: bc35965f6940a9bf834d54187b6088b8eb09206d
change-id: 20260904-nr_mmios-868e369de25b

Best regards,
--  
GUO Ren (XuanTie) <guoren@kernel.org>

Re: [PATCH] irqchip/riscv-imsic: Fix MMIO regset lookup loop bound

[Guo Ren]

Sorry, I didn't notice this:

https://lore.kernel.org/linux-riscv/20260718033646.001.7e022554-caplitmus-rv@iscas.ac.cn/

Please abandon this patch.

On Fri, Sep 4, 2026 at 10:32 PM GUO Ren (XuanTie) <guoren@kernel.org> wrote:
>
> The nr_mmios is the number of entries in the MMIO resource array, while
> j is the index used to iterate over the array. Testing nr_mmios directly
> makes the loop condition permanently true whenever at least one MMIO
> region exists.
>
> So, change
>   for (j = 0; nr_mmios; j++) {
> to
>   for (j = 0; j < nr_mmios; j++) {
>
> Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: GUO Ren (XuanTie) <guoren@kernel.org>
> ---
> This patch fixes an out-of-bounds access in the RISC-V IMSIC MMIO
> resource lookup.
> ---
>  drivers/irqchip/irq-riscv-imsic-state.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
> index b8d1bbbf42f7..008dfcf343e5 100644
> --- a/drivers/irqchip/irq-riscv-imsic-state.c
> +++ b/drivers/irqchip/irq-riscv-imsic-state.c
> @@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
>                 index = nr_mmios;
>                 reloff = i * BIT(global->guest_index_bits) *
>                          IMSIC_MMIO_PAGE_SZ;
> -               for (j = 0; nr_mmios; j++) {
> +               for (j = 0; j < nr_mmios; j++) {
>                         if (reloff < resource_size(&mmios[j])) {
>                                 index = j;
>                                 break;
>
> ---
> base-commit: bc35965f6940a9bf834d54187b6088b8eb09206d
> change-id: 20260904-nr_mmios-868e369de25b
>
> Best regards,
> --
> GUO Ren (XuanTie) <guoren@kernel.org>
>

-- 
Best Regards
 Guo Ren

[PATCH] irqchip/riscv-imsic: Fix MMIO regset lookup loop bound

[Pengpeng Hou]

nr_mmios is the number of elements in the MMIO resource arrays, while j is
the index that advances through them. The loop currently tests the nonzero
count on every iteration. If no region contains reloff, it reads past mmios
before reaching the existing not-found check.

Compare j with nr_mmios. This preserves successful lookups and lets the
not-found path handle an offset beyond the listed regions.

Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/irqchip/irq-riscv-imsic-state.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
index b8d1bbbf42f73..008dfcf343e53 100644
--- a/drivers/irqchip/irq-riscv-imsic-state.c
+++ b/drivers/irqchip/irq-riscv-imsic-state.c
@@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
 		index = nr_mmios;
 		reloff = i * BIT(global->guest_index_bits) *
 			 IMSIC_MMIO_PAGE_SZ;
-		for (j = 0; nr_mmios; j++) {
+		for (j = 0; j < nr_mmios; j++) {
 			if (reloff < resource_size(&mmios[j])) {
 				index = j;
 				break;
-- 
2.43.0

Re: [PATCH] irqchip/riscv-imsic: Fix MMIO regset lookup loop bound

[Anup Patel]

On Sat, Jul 18, 2026 at 9:21 AM Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:
>
> nr_mmios is the number of elements in the MMIO resource arrays, while j is
> the index that advances through them. The loop currently tests the nonzero
> count on every iteration. If no region contains reloff, it reads past mmios
> before reaching the existing not-found check.
>
> Compare j with nr_mmios. This preserves successful lookups and lets the
> not-found path handle an offset beyond the listed regions.
>
> Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Thanks,
Anup

> ---
>  drivers/irqchip/irq-riscv-imsic-state.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
> index b8d1bbbf42f73..008dfcf343e53 100644
> --- a/drivers/irqchip/irq-riscv-imsic-state.c
> +++ b/drivers/irqchip/irq-riscv-imsic-state.c
> @@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
>                 index = nr_mmios;
>                 reloff = i * BIT(global->guest_index_bits) *
>                          IMSIC_MMIO_PAGE_SZ;
> -               for (j = 0; nr_mmios; j++) {
> +               for (j = 0; j < nr_mmios; j++) {
>                         if (reloff < resource_size(&mmios[j])) {
>                                 index = j;
>                                 break;
> --
> 2.43.0
>

Re: [PATCH] irqchip/riscv-imsic: Fix MMIO regset lookup loop bound

[Anup Patel]

On Sat, Jul 18, 2026 at 9:21 AM Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:
>
> nr_mmios is the number of elements in the MMIO resource arrays, while j is
> the index that advances through them. The loop currently tests the nonzero
> count on every iteration. If no region contains reloff, it reads past mmios
> before reaching the existing not-found check.
>
> Compare j with nr_mmios. This preserves successful lookups and lets the
> not-found path handle an offset beyond the listed regions.
>
> Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

I just recalled that a similar fix was already posted a week ago
by "Haofeng Li <lihaofeng@kylinos.cn>" with patch subject
"irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup"

Regards,
Anup

> ---
>  drivers/irqchip/irq-riscv-imsic-state.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
> index b8d1bbbf42f73..008dfcf343e53 100644
> --- a/drivers/irqchip/irq-riscv-imsic-state.c
> +++ b/drivers/irqchip/irq-riscv-imsic-state.c
> @@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
>                 index = nr_mmios;
>                 reloff = i * BIT(global->guest_index_bits) *
>                          IMSIC_MMIO_PAGE_SZ;
> -               for (j = 0; nr_mmios; j++) {
> +               for (j = 0; j < nr_mmios; j++) {
>                         if (reloff < resource_size(&mmios[j])) {
>                                 index = j;
>                                 break;
> --
> 2.43.0
>