From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta0.migadu.com (out-178.mta0.migadu.com [91.218.175.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB3B73EAC8F for ; Fri, 25 Sep 2026 08:50:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790326226; cv=none; b=otz+M5iXN7bJxalIgpNJkIlSWFCvPsLZBsEhr/8VIXJuNNPItk/c1L5xHPd2xWKbk9tQkTISc76LWHs6bJhN0sLFSYixY2Xg8+DCj/kHsNW2WYHOW2PszI81QBnWFjhOb5KFzp7qpZdOcVFgrPIP4mhkseGfQWFA9AYOdPmHpRk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790326226; c=relaxed/simple; bh=Gcr8hLNdqy1k42dqWVISdXk8rlCA5k+esFk5lI0c9bw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=VAalOVLlMicX77LC1v3tySFL0IfQyZGc+2pMOpFjK5FMmLtM1R6vkDk9MWJK6dcHum/SY51j+3lB26+rP/BZUiFWevBV54eD9Qd9aTRoBrw8WxXe40iwZLKFQgCCwbFswkIoIpAFgRRTSro7H3aw2F+YAEPWXh1yQp3O54S1bzI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=NU/j46GE; arc=none smtp.client-ip=91.218.175.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="NU/j46GE" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=Gcr8hLNdqy1k42dqWVISdXk8rlCA5k+esFk5lI0c9bw=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1790326216; v=1; x=1790931016; b=NU/j46GENzhmQ4fg3qB4ky9J1Pgi8mIvC0P1eQL7NnTUxMuy1ZZF/RCgdWLfTigoD/Z8ivs0 LvRJ1Yr+EIBTiP6bWpSpj3El7SL17WOSASUu7NC7S9Fmlbivj0oN0RCTrkwSPeKbMzzf/sZrREb PSpXjh/i2LXvL7zW3e3I0MUU= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id ff18a72ce455d391; Fri, 25 Sep 2026 08:50:14 +0000 X-Mizu-Trace-ID: ff18a72ce455d391 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Thomas Gleixner Cc: Radu Rendec , James Morse , Will Deacon , Fuad Tabba , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] irqchip/gic-v3-its: Don't free the tables of an enabled ITS Date: Fri, 25 Sep 2026 09:49:59 +0100 Message-Id: <20260925085000.753400-3-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260925085000.753400-1-fuad.tabba@linux.dev> References: <20260925085000.753400-1-fuad.tabba@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit its_probe_one() enables the ITS before its_init_domain(), the last step that can fail, and the unwind from there frees the tables and the command queue without disabling it. The kernel comes up with an enabled ITS pointing at freed pages. Enable the ITS last. Nothing reaches the new domain before then: this runs from init_IRQ(), and the ITS joins its_nodes only after the enable. Fixes: 4c21f3c26ecc2 ("irqchip: GICv3: ITS: DT probing and initialization") Signed-off-by: Fuad Tabba --- drivers/irqchip/irq-gic-v3-its.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 58e52095e6ea8..a5690721f0feb 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -5332,16 +5332,18 @@ static int __init its_probe_one(struct its_node *its) } gits_write_cwriter(0, its->base + GITS_CWRITER); + + err = its_init_domain(its); + if (err) + goto out_free_collection; + + /* Enable last: the unwind frees memory an enabled ITS may access */ ctlr = readl_relaxed(its->base + GITS_CTLR); ctlr |= GITS_CTLR_ENABLE; if (is_v4(its)) ctlr |= GITS_CTLR_ImDe; writel_relaxed(ctlr, its->base + GITS_CTLR); - err = its_init_domain(its); - if (err) - goto out_free_collection; - raw_spin_lock(&its_lock); list_add(&its->entry, &its_nodes); raw_spin_unlock(&its_lock); -- 2.39.5