[PATCH] spmi: pmic-arb: bound id before using it as the IRQ ID field in spec_to_hwirq()

[PATCH] spmi: pmic-arb: bound id before using it as the IRQ ID field in spec_to_hwirq()

[Jishnu Prakash]

periph_interrupt() derives id from ffs(status) - 1, giving the compiler
no source-level guarantee that id stays within the 3-bit range of
HWIRQ_IRQID_MASK before it is passed to spec_to_hwirq()'s
FIELD_PREP(HWIRQ_IRQID_MASK, id). On targets where ffs() has no native
instruction and is expanded in software (e.g. MIPS), the expansion's
internal handling of the "no bit set" case lets some compilers prove id
is a literal that overflows the field along that path, even though the
enclosing while (status) loop guarantees it is never taken. This trips
FIELD_PREP()'s compile-time "value too large for the field" check.

Clamp id to HWIRQ_IRQID_MASK's width (via FIELD_MAX()) right after
computing it, so the "no bit set" literal is bounded to the field's max
value instead of overflowing it.

Root cause and fix were diagnosed and verified with AI assistance.
Reviewed and tested by the author.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610260532.Zb5KDgRE-lkp@intel.com/
Fixes: 815be38ad8c8 ("spmi: spmi-pmic-arb: add support for PMIC arbiter v8")
Signed-off-by: Jishnu Prakash <jishnu.prakash@oss.qualcomm.com>
---
 drivers/spmi/spmi-pmic-arb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
index 402ffeaff8e2..6f8a490f47a3 100644
--- a/drivers/spmi/spmi-pmic-arb.c
+++ b/drivers/spmi/spmi-pmic-arb.c
@@ -736,7 +736,7 @@ static int periph_interrupt(struct spmi_pmic_arb_bus *bus, u16 apid)
 
 	status = readl_relaxed(pmic_arb->ver_ops->irq_status(bus, apid));
 	while (status) {
-		id = ffs(status) - 1;
+		id = (ffs(status) - 1) & FIELD_MAX(HWIRQ_IRQID_MASK);
 		status &= ~BIT(id);
 		irq = irq_find_mapping(bus->domain,
 				       spec_to_hwirq(sid, per, id, apid));

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261103-spmi-pmic-arb-fieldprep-fix-5b63ff0ea043

Best regards,
--  
Jishnu Prakash <jishnu.prakash@oss.qualcomm.com>

Re: [PATCH] spmi: pmic-arb: bound id before using it as the IRQ ID field in spec_to_hwirq()

[Konrad Dybcio]

On 11/3/26 11:05 AM, Jishnu Prakash wrote:
> periph_interrupt() derives id from ffs(status) - 1, giving the compiler
> no source-level guarantee that id stays within the 3-bit range of
> HWIRQ_IRQID_MASK before it is passed to spec_to_hwirq()'s
> FIELD_PREP(HWIRQ_IRQID_MASK, id). On targets where ffs() has no native
> instruction and is expanded in software (e.g. MIPS), the expansion's
> internal handling of the "no bit set" case lets some compilers prove id
> is a literal that overflows the field along that path, even though the
> enclosing while (status) loop guarantees it is never taken. This trips
> FIELD_PREP()'s compile-time "value too large for the field" check.
> 
> Clamp id to HWIRQ_IRQID_MASK's width (via FIELD_MAX()) right after
> computing it, so the "no bit set" literal is bounded to the field's max
> value instead of overflowing it.
> 
> Root cause and fix were diagnosed and verified with AI assistance.
> Reviewed and tested by the author.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202610260532.Zb5KDgRE-lkp@intel.com/
> Fixes: 815be38ad8c8 ("spmi: spmi-pmic-arb: add support for PMIC arbiter v8")
> Signed-off-by: Jishnu Prakash <jishnu.prakash@oss.qualcomm.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad

Re: [PATCH] spmi: pmic-arb: bound id before using it as the IRQ ID field in spec_to_hwirq()

[Abel Vesa]

On 26-11-03 15:35:16, Jishnu Prakash wrote:
> periph_interrupt() derives id from ffs(status) - 1, giving the compiler
> no source-level guarantee that id stays within the 3-bit range of
> HWIRQ_IRQID_MASK before it is passed to spec_to_hwirq()'s
> FIELD_PREP(HWIRQ_IRQID_MASK, id). On targets where ffs() has no native
> instruction and is expanded in software (e.g. MIPS), the expansion's
> internal handling of the "no bit set" case lets some compilers prove id
> is a literal that overflows the field along that path, even though the
> enclosing while (status) loop guarantees it is never taken. This trips
> FIELD_PREP()'s compile-time "value too large for the field" check.
> 
> Clamp id to HWIRQ_IRQID_MASK's width (via FIELD_MAX()) right after
> computing it, so the "no bit set" literal is bounded to the field's max
> value instead of overflowing it.
> 
> Root cause and fix were diagnosed and verified with AI assistance.
> Reviewed and tested by the author.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202610260532.Zb5KDgRE-lkp@intel.com/
> Fixes: 815be38ad8c8 ("spmi: spmi-pmic-arb: add support for PMIC arbiter v8")
> Signed-off-by: Jishnu Prakash <jishnu.prakash@oss.qualcomm.com>

Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>