[PATCH 0/3] irqchip/gic-v3: Lifetime and range fixes in the GICv3 and ITS drivers

[PATCH 0/3] irqchip/gic-v3: Lifetime and range fixes in the GICv3 and ITS drivers

[Fuad Tabba]

Hi folks,

Three fixes to the GICv3 and ITS drivers, from reviewing the GIC series
floating around and chasing down Sashiko's reports.

The first releases the partition node that gic_irq_get_fwspec_info()
takes from of_find_node_by_phandle() and never puts. Sashiko raised it
on an of/irq patch of mine, and I said a fix was forthcoming [1].

The second widens the per-device MSI clamp, which truncates to zero when
GITS_TYPER.ID_bits is at its maximum and then denies every MSI on that
ITS. I couldn't find an implementation that reports that maximum, so
this is one value at the edge rather than something anyone is hitting.
It carries Cc: stable because the commit it fixes was itself
backported, so drop the tag if you'd rather.

The third clears vpt_page once its_vpe_teardown() has freed it, so the
NULL guard holds if teardown runs again on the same vPE.

Based on Linux 7.3-rc2 (df2908090cda3).

Cheers,
/fuad

[1] https://lore.kernel.org/all/CA+EHjTx7eP_30vP47=UFk_wMAut-2uf+2DF-MZqn2SLE_k-8qg@mail.gmail.com/

Fuad Tabba (3):
  irqchip/gic-v3: Release the partition node in
    gic_irq_get_fwspec_info()
  irqchip/gic-v3-its: Don't clamp nvecs to zero when id_bits is 32
  irqchip/gic-v3-its: Clear vpt_page after freeing the pending table

 drivers/irqchip/irq-gic-v3-its.c | 3 ++-
 drivers/irqchip/irq-gic-v3.c     | 7 ++++---
 2 files changed, 6 insertions(+), 4 deletions(-)


base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.39.5

[PATCH 1/3] irqchip/gic-v3: Release the partition node in gic_irq_get_fwspec_info()

[Fuad Tabba]

gic_irq_get_fwspec_info() never puts the node it takes from
of_find_node_by_phandle(), so every lookup from a four-cell PPI or EPPI
specifier naming a partition leaks one.

The node is only used for the comparison against gic_data.parts[], and
the mask returned points into gic_data, so it can go out of scope with
the lookup.

Fixes: 68905ea65ceff ("irqchip/gic-v3: Add FW info retrieval support")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 drivers/irqchip/irq-gic-v3.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 6e1fa5b247fc4..b0142b0a93fa4 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -1728,8 +1728,6 @@ static int gic_irq_get_fwspec_info(struct irq_fwspec *fwspec, struct irq_fwspec_
 
 	/* If the specifier provides an affinity, use it */
 	if (fwspec->param_count == 4 && fwspec->param[3]) {
-		struct fwnode_handle *fw;
-
 		switch (fwspec->param[0]) {
 		case 1:			/* PPI */
 		case 3:			/* EPPI */
@@ -1738,7 +1736,10 @@ static int gic_irq_get_fwspec_info(struct irq_fwspec *fwspec, struct irq_fwspec_
 			return 0;
 		}
 
-		fw = of_fwnode_handle(of_find_node_by_phandle(fwspec->param[3]));
+		struct device_node *np __free(device_node) =
+			of_find_node_by_phandle(fwspec->param[3]);
+		struct fwnode_handle *fw = of_fwnode_handle(np);
+
 		if (!fw)
 			return -ENOENT;
 
-- 
2.39.5

[PATCH 2/3] irqchip/gic-v3-its: Don't clamp nvecs to zero when id_bits is 32

[Fuad Tabba]

GITS_TYPER_IDBITS is five bits, so id_bits reaches 32 and
min_t(unsigned int, ...) truncates BIT(32) to 0. nvecs becomes 0,
its_lpi_alloc() rejects that, and its_msi_prepare() returns -ENOMEM.
On 32-bit ARM the shift is undefined instead.

The clamp is correct for every value below the maximum, so only that
one value is affected.

Fixes: ce9e40a9a5e5c ("irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports")
Cc: stable@vger.kernel.org
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 drivers/irqchip/irq-gic-v3-its.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index e9807af235373..81a96149f9154 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -3484,7 +3484,7 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
 	 * Also honor the ITS's own EID limit.
 	 */
 	id_bits = FIELD_GET(GITS_TYPER_IDBITS, its->typer) + 1;
-	nvecs = min_t(unsigned int, nvecs, BIT(id_bits));
+	nvecs = min_t(u64, nvecs, BIT_ULL(id_bits));
 	nr_ites = max(2, nvecs);
 	sz = nr_ites * (FIELD_GET(GITS_TYPER_ITT_ENTRY_SIZE, its->typer) + 1);
 	sz = max(sz, ITS_ITT_ALIGN);
-- 
2.39.5

[PATCH 3/3] irqchip/gic-v3-its: Clear vpt_page after freeing the pending table

[Fuad Tabba]

its_vpe_teardown() frees vpt_page without clearing it, so its
vpt_page == NULL guard only holds the first time it runs on a vPE.
struct its_vpe outlives a failed KVM_DEV_ARM_VGIC_CTRL_INIT, so a retry
that fails again frees the pending table and the vPE ID a second time.

Fixes: 325ff3e78c64c ("irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 drivers/irqchip/irq-gic-v3-its.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 81a96149f9154..f5d89e829c168 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -4599,6 +4599,7 @@ static void its_vpe_teardown(struct its_vpe *vpe)
 	its_vpe_db_proxy_unmap(vpe);
 	its_vpe_id_free(vpe->vpe_id);
 	its_free_pending_table(vpe->vpt_page);
+	vpe->vpt_page = NULL;
 }
 
 static void its_vpe_irq_domain_free(struct irq_domain *domain,
-- 
2.39.5

Re: [PATCH 0/3] irqchip/gic-v3: Lifetime and range fixes in the GICv3 and ITS drivers

[Marc Zyngier]

On Tue, 08 Sep 2026 15:26:29 +0100,
Fuad Tabba <fuad.tabba@linux.dev> wrote:
> 
> Hi folks,
> 
> Three fixes to the GICv3 and ITS drivers, from reviewing the GIC series
> floating around and chasing down Sashiko's reports.
> 
> The first releases the partition node that gic_irq_get_fwspec_info()
> takes from of_find_node_by_phandle() and never puts. Sashiko raised it
> on an of/irq patch of mine, and I said a fix was forthcoming [1].
> 
> The second widens the per-device MSI clamp, which truncates to zero when
> GITS_TYPER.ID_bits is at its maximum and then denies every MSI on that
> ITS. I couldn't find an implementation that reports that maximum, so
> this is one value at the edge rather than something anyone is hitting.
> It carries Cc: stable because the commit it fixes was itself
> backported, so drop the tag if you'd rather.
> 
> The third clears vpt_page once its_vpe_teardown() has freed it, so the
> NULL guard holds if teardown runs again on the same vPE.
> 
> Based on Linux 7.3-rc2 (df2908090cda3).

Reviewed-by: Marc Zyngier <maz@kernel.org>

	M.

-- 
Without deviation from the norm, progress is not possible.