[PATCH 0/3] irqchip/gic-v3: Memory-safety fixes on the probe paths

[Fuad Tabba <fuad.tabba@linux.dev>]

Hi folks,

Three probe-time bugs in the GICv3 drivers. The kernel keeps running
after each of them, so the memory involved is live rather than on the
way to a reset.

The first two free memory an enabled ITS still points at. Boot carries
on because its_init() discards a failed probe and gic_init_bases()
discards what its_init() returns. The third is a write past the end of
redist_regs[] for an enabled GICC with a zero GICR base.
fa2dabe57220e's commit message says such tables exist, and I haven't
seen one.

Based on Linux 7.3-rc4 (93f51579e7df2).

Cheers,
/fuad

Fuad Tabba (3):
  irqchip/gic-v3-its: Don't free a vPE table shared with another ITS
  irqchip/gic-v3-its: Don't free the tables of an enabled ITS
  irqchip/gic-v3: Don't register a redistributor that was never counted

 drivers/irqchip/irq-gic-v3-its.c | 16 +++++++++++-----
 drivers/irqchip/irq-gic-v3.c     |  6 ++++++
 2 files changed, 17 insertions(+), 5 deletions(-)


base-commit: 93f51579e7df248780214094418f205253383cc5
-- 
2.39.5