[PATCH] arm_mpam: Reject ris_idx == MPAM_MSC_MAX_NUM_RIS

[PATCH] arm_mpam: Reject ris_idx == MPAM_MSC_MAX_NUM_RIS

[Ping Li]

While checking the driver's partid and ris bound checks, after the
hardware team mistakenly configured PARTID_MAX in an MSC to 16,
this issue was found: MPAM_MSC_MAX_NUM_RIS is the max number of
RIS an MSC can have, so a ris_idx of 16 passes the current check,
and would later be silently truncated to 0 by FIELD_PREP(),
landing all configuration for that ris on RIS 0.

Signed-off-by: Ping Li <leeonion.muyu@gmail.com>
---
 drivers/resctrl/mpam_devices.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c
index 48adc49b833c..347a5a6d6a1d 100644
--- a/drivers/resctrl/mpam_devices.c
+++ b/drivers/resctrl/mpam_devices.c
@@ -700,7 +700,7 @@ static int mpam_ris_create_locked(struct mpam_msc *msc, u8 ris_idx,
 
 	lockdep_assert_held(&mpam_list_lock);
 
-	if (ris_idx > MPAM_MSC_MAX_NUM_RIS)
+	if (ris_idx >= MPAM_MSC_MAX_NUM_RIS)
 		return -EINVAL;
 
 	if (test_and_set_bit(ris_idx, &msc->ris_idxs))
-- 
2.34.1

Re: [PATCH] arm_mpam: Reject ris_idx == MPAM_MSC_MAX_NUM_RIS

[Ben Horgan]

Hi Ping,

On 22/10/2026 09:57, Ping Li wrote:
> While checking the driver's partid and ris bound checks, after the
> hardware team mistakenly configured PARTID_MAX in an MSC to 16,
> this issue was found: MPAM_MSC_MAX_NUM_RIS is the max number of
> RIS an MSC can have, so a ris_idx of 16 passes the current check,
> and would later be silently truncated to 0 by FIELD_PREP(),
> landing all configuration for that ris on RIS 0.
> 
> Signed-off-by: Ping Li <leeonion.muyu@gmail.com>

Thanks for the patch. Yin already found the same bug and posted a fix first so I'll go with that one.

https://lore.kernel.org/linux-arm-kernel/20261008-mpam-resctrl-dt-knp-support-v3-1-35196c2b43bf@oss.qualcomm.com/

Thanks,

Ben

> ---
>  drivers/resctrl/mpam_devices.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c
> index 48adc49b833c..347a5a6d6a1d 100644
> --- a/drivers/resctrl/mpam_devices.c
> +++ b/drivers/resctrl/mpam_devices.c
> @@ -700,7 +700,7 @@ static int mpam_ris_create_locked(struct mpam_msc *msc, u8 ris_idx,
>  
>  	lockdep_assert_held(&mpam_list_lock);
>  
> -	if (ris_idx > MPAM_MSC_MAX_NUM_RIS)
> +	if (ris_idx >= MPAM_MSC_MAX_NUM_RIS)
>  		return -EINVAL;
>  
>  	if (test_and_set_bit(ris_idx, &msc->ris_idxs))