Re: [PATCH] sh: intc: sort the prio and sense lists after filling them

[John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>]

Hi Karl,

On Sun, 2026-09-27 at 21:13 +0200, Karl Mehltretter wrote:
> register_intc_controller() sorts d->prio and d->sense right after
> allocating them, with hw->nr_prio_regs and hw->nr_sense_regs as the
> element count. The lists hold hw->nr_vectors entries and are only
> filled later, by intc_register_irq().
> 
> On SH7785, sh7785-irq0123 and sh7785-irq4567 have four vectors but the
> SoC's eleven priority registers, so sort() swaps 88 bytes in a 32 byte
> kmalloc object at boot. slub_debug=FZPU reports "Right Redzone
> overwritten" in kmalloc-32, and v6.5 and v6.6 panic in
> __kmem_cache_alloc_node() while registering sh7785-irq0123.
> 
> Found with a custom QEMU model of the SH7785LCR. On it, v6.4
> sh7785lcr_defconfig boots with SLAB, the defconfig default before v6.5,
> and hangs before the console is up when built with SLUB.
> 
> Sort the lists once all vectors are registered, with the number of
> entries that were added.
> 
> Fixes: b59f9f9775e6 ("sh: intc: optimize intc IRQ lookup")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> 
> Notes:
>     Testing, all in QEMU on a custom SH7785LCR model, not on hardware:
>     - v6.5 and v6.6 sh7785lcr_defconfig hang before the console is up
>       (gcc 8 and gcc 14). With slub_debug=FZPU they boot and validating
>       kmalloc-32 reports "Right Redzone overwritten" after the object
>       holding the entries of sh7785-irq4567. With this patch they boot
>       and the report is gone.
>     - v6.4 sh7785lcr_defconfig (SLAB) boots. The same v6.4 built with SLUB
>       hangs, reports the overflow with slub_debug=FZPU, and boots with
>       this patch.
>     - Current mainline boots with or without the patch, but reports the
>       overflow with slub_debug=FZPU unless patched.
>     Testing on real hardware is welcome.
> 
>  drivers/sh/intc/core.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
> index aa68fe190865d..ffbe60234eefc 100644
> --- a/drivers/sh/intc/core.c
> +++ b/drivers/sh/intc/core.c
> @@ -275,9 +275,6 @@ int __init register_intc_controller(struct intc_desc *desc)
>  			k += save_reg(d, k, hw->prio_regs[i].set_reg, smp);
>  			k += save_reg(d, k, hw->prio_regs[i].clr_reg, smp);
>  		}
> -
> -		sort(d->prio, hw->nr_prio_regs, sizeof(*d->prio),
> -		     intc_handle_int_cmp, NULL);
>  	}
>  
>  	if (hw->sense_regs) {
> @@ -287,9 +284,6 @@ int __init register_intc_controller(struct intc_desc *desc)
>  
>  		for (i = 0; i < hw->nr_sense_regs; i++)
>  			k += save_reg(d, k, hw->sense_regs[i].reg, 0);
> -
> -		sort(d->sense, hw->nr_sense_regs, sizeof(*d->sense),
> -		     intc_handle_int_cmp, NULL);
>  	}
>  
>  	if (hw->subgroups)
> @@ -357,6 +351,11 @@ int __init register_intc_controller(struct intc_desc *desc)
>  		}
>  	}
>  
> +	sort(d->prio, d->nr_prio, sizeof(*d->prio),
> +	     intc_handle_int_cmp, NULL);
> +	sort(d->sense, d->nr_sense, sizeof(*d->sense),
> +	     intc_handle_int_cmp, NULL);
> +
>  	intc_subgroup_init(desc, d);
>  
>  	/* enable bits matching force_enable after registering irqs */

I tried this patch and the kernel still gets stuck for me after loading it
with u-boot, the problem that I have been seeing since 6.5.0 and haven't
been able to resolve.

=> usb reset; fatload usb 0:1 0x89000000 uImage-7.3.0.gz ; pmb ; bootm
(Re)start USB...
USB0:   scanning bus 0 for devices... 2 USB Device(s) found
       scanning usb for storage devices... 1 Storage Device(s) found
reading uImage-7.3.0.gz
3649306 bytes read in 2074 ms (1.7 MiB/s)
## Booting kernel from Legacy Image at 89000000 ...
   Image Name:   Linux-7.3.0-rc5-00001-g8cd915e93
   Image Type:   SuperH Linux Kernel Image (gzip compressed)
   Data Size:    3649242 Bytes = 3.5 MiB
   Load Address: 8c010000
   Entry Point:  8c011000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

I also never understood why the load address I used at the u-boot prompt
differed from the one that the uImage build process showed at the end of
the kernel build:

  GZIP    arch/sh/boot/vmlinux.bin.gz
  UIMAGE  arch/sh/boot/uImage.gz
Image Name:   Linux-7.3.0-rc5-00002-g02d53450e
Created:      Mon Sep 28 14:56:15 2026
Image Type:   SuperH Linux Kernel Image (gzip compressed)
Data Size:    3649249 Bytes = 3563.72 KiB = 3.48 MiB
Load Address: 8c010000
Entry Point:  8c011000
  Image arch/sh/boot/uImage is ready

Any idea?

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913