Re: [tip: irq/drivers] irqchip/imx-irqsteer: Validate IRQ count before creating domain

[Radu Rendec <radu@rendec.net>]

On Sun, 2026-11-08 at 19:31 -0800, Borislav Petkov wrote:
> On Sun, Nov 08, 2026 at 09:49:39PM -0000, tip-bot2 for Fabio Estevam wrote:
> > The following commit has been merged into the irq/drivers branch of tip:
> > 
> > Commit-ID:     f99f3c4acaff0df9393c1e6a3f28b7b974e01d95
> > Gitweb:        https://git.kernel.org/tip/f99f3c4acaff0df9393c1e6a3f28b7b974e01d95
> > Author:        Fabio Estevam <festevam@nabladev.com>
> > AuthorDate:    Wed, 04 Nov 2026 16:37:50 +09:00
> > Committer:     Thomas Gleixner <tglx@kernel.org>
> > CommitterDate: Sun, 08 Nov 2026 22:43:43 +01:00
> > 
> > irqchip/imx-irqsteer: Validate IRQ count before creating domain
> > 
> > The IRQ count is validated after creating the IRQ domain. If it is
> > invalid, probe returns without removing the domain, leaving its host
> > data pointing at devm-managed memory that is freed on probe failure.
> > 
> > Validate the count before allocating resources to avoid the leak and
> > dangling pointer.
> > 
> > Fixes: 28528fca4908 ("irqchip/imx-irqsteer: Add multi output interrupts support")
> > Signed-off-by: Fabio Estevam <festevam@nabladev.com>
> > Signed-off-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
> > Signed-off-by: Thomas Gleixner <tglx@kernel.org>
> > Reviewed-by: Frank Li <Frank.Li@nxp.com>
> > Reviewed-by: Radu Rendec <radu@rendec.net>
> > Link: https://patch.msgid.link/20261104073759.386777-3-Zhipeng.wang_1@oss.nxp.com
> > ---
> >  drivers/irqchip/irq-imx-irqsteer.c | 7 ++-----
> >  1 file changed, 2 insertions(+), 5 deletions(-)
> > 
> > diff --git a/drivers/irqchip/irq-imx-irqsteer.c b/drivers/irqchip/irq-imx-irqsteer.c
> > index 1b8d0c8..766756e 100644
> > --- a/drivers/irqchip/irq-imx-irqsteer.c
> > +++ b/drivers/irqchip/irq-imx-irqsteer.c
> > @@ -218,6 +218,8 @@ static int imx_irqsteer_probe(struct platform_device *pdev)
> >  	 */
> >  	data->irq_count = DIV_ROUND_UP(irqs_num, 64);
> >  	data->reg_num = irqs_num / 32;
> > +	if (!data->irq_count || data->irq_count > CHAN_MAX_OUTPUT_INT)
> > +		return -EINVAL;
> >  
> >  	if (IS_ENABLED(CONFIG_PM)) {
> >  		data->saved_reg = devm_kzalloc(&pdev->dev,
> > @@ -246,11 +248,6 @@ static int imx_irqsteer_probe(struct platform_device *pdev)
> >  	}
> >  	irq_domain_set_pm_device(data->domain, &pdev->dev);
> >  
> > -	if (!data->irq_count || data->irq_count > CHAN_MAX_OUTPUT_INT) {
> > -		ret = -EINVAL;
> > -		goto out;
> > -	}
> > -
> >  	for (i = 0; i < data->irq_count; i++) {
> >  		data->irq[i] = irq_of_parse_and_map(np, i);
> >  		if (!data->irq[i])
> 
> I'm guessing it is this one because it removes the "goto out;" around the
> 2xx-ish linenumbers but forgets to remove the out: label itself:
> 
> drivers/irqchip/irq-imx-irqsteer.c: In function ‘imx_irqsteer_probe’:
> drivers/irqchip/irq-imx-irqsteer.c:271:1: error: label ‘out’ defined but not used [-Werror=unused-label]
>   271 | out:
>       | ^~~

The culprit seems to be 54ac29cd1111 ("irqchip/imx-irqsteer: Let devres
own the clock"). I think Thomas had reworked the patches (particularly
the controversial part about the pm_runtime and clock control
management) before he applied them to the irq/drivers tip branch.

The commit posted to the mailing list removed the clk_disable_unprepare()
at the end of the function, along with the "out" label. The one in the
tip branch does not remove either. I guess the intention was to keep the
call, but the label slipped through.

> cc1: all warnings being treated as errors
> make[4]: *** [scripts/Makefile.build:290: drivers/irqchip/irq-imx-irqsteer.o] Error 1
> make[4]: *** Waiting for unfinished jobs....
> make[3]: *** [scripts/Makefile.build:572: drivers/irqchip] Error 2
> make[3]: *** Waiting for unfinished jobs....
> 
> An allmodconfig x86_64.