From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.mindbit.ro (xs1.mindbit.ro [80.86.107.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A13F1EEA54 for ; Sat, 25 Jul 2026 15:36:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=80.86.107.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993819; cv=none; b=JrBZQ3x7OKyUTWVlvLkdyi5eYJCQvUlSLLrlsoPw68qBfrp3ZFLaESZBpPAwgwCf6N0VjOXcvVFFGRUJQHP+q8v8Sfa3emMNmcRhux8wXXIlQp7pf5fADlB45JloMKDD2B3xVOOXq9wGHFCukXTGRvB9h0LOSB/5tad1R/AmXEw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784993819; c=relaxed/simple; bh=mV8JzRbtOeeLBPSu45VWiZwu4s6l+pYVX2UR/zkBUZo=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=caYVXhFbJQJMNSgUOV0dgKi8nsEL56FEajNfPo+tOv6Ghq32ZC3FlLuO1Q7WxTjjurmAeCHapNqaFKruZa6mDO2XMQ95WfR82prfIsr8O6LUQ0iXp7R0c9UgEXhlHBR/jczlG3W1UyeQVkLn6uFVWVaB3ol7r9OZ7K1dhp0z8hU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=rendec.net; spf=pass smtp.mailfrom=rendec.net; dkim=pass (2048-bit key) header.d=rendec.net header.i=@rendec.net header.b=LQS3GQzs; arc=none smtp.client-ip=80.86.107.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=rendec.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rendec.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rendec.net header.i=@rendec.net header.b="LQS3GQzs" Received: from dog.kanata.rendec.net (pool-174-112-193-187.cpe.net.cable.rogers.com [174.112.193.187]) by mail.mindbit.ro (Postfix) with ESMTPSA id 115E5C289F; Sat, 25 Jul 2026 18:36:45 +0300 (EEST) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.mindbit.ro 115E5C289F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rendec.net; s=default; t=1784993807; bh=ij4llYX0IY1/Z2saSrJWqE8S/DUJX8rjYqL/9Jp3mvg=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=LQS3GQzsZQSkrjDmR3TcA+zLlZ/AuyxldNA6e7SmFZT3kU8wgZB5SAiu9B2uzD14r JS23kgRJtOxN/69zHEEeI9Tfnl8FteYTwKaeX1mZvpZTolyI34CoHFf12SKCHh3U3t t8NJsSA75Q0wzEiteM4011NVXj1/Br4k4JZKZQivlbo2ukTqGyvvVR2BdHm02V9Rvn Mi5suL/jCa8nXfXM2ZEAZFWoyVrVWaEfD+cABLkjdyDmlTq+0xpwh0JThmQHtpmEug vUbYVo6py9ZujBkyjXq8zy6KUYI+S6/HkbP6WEzarQb//ZJ4UVcL4IhxuC9lAFPELm OQ6liC8cOicjg== Message-ID: Subject: Re: [PATCH] irqchip/mst-intc: reject ranges beyond saved state capacity From: Radu Rendec To: Pengpeng Hou , Mark-PK Tsai Cc: Daniel Palmer , Thomas Gleixner , Matthias Brugger , AngeloGioacchino Del Regno , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org Date: Sat, 25 Jul 2026 11:36:44 -0400 In-Reply-To: <20260722041443.10020-1-pengpeng@iscas.ac.cn> References: <20260722041443.10020-1-pengpeng@iscas.ac.cn> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.3 (3.58.3-1.fc43) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Wed, 2026-07-22 at 12:14 +0800, Pengpeng Hou wrote: > The inclusive Device Tree IRQ range determines nr_irqs. Suspend and > resume then use nr_irqs to walk the fixed saved_status array, which has > MST_INTC_MAX_IRQS entries. A descending range underflows the unsigned > subtraction, while a range wider than 64 entries exceeds that array. >=20 > Reject both forms before deriving nr_irqs. >=20 > Signed-off-by: Pengpeng Hou > --- > =C2=A0drivers/irqchip/irq-mst-intc.c | 4 ++++ > =C2=A01 file changed, 4 insertions(+) >=20 > diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-int= c.c > index b5335f6fd6d6..1475335d668d 100644 > --- a/drivers/irqchip/irq-mst-intc.c > +++ b/drivers/irqchip/irq-mst-intc.c > @@ -263,6 +263,10 @@ static int __init mst_intc_of_init(struct device_nod= e *dn, > =C2=A0 =C2=A0=C2=A0=C2=A0 of_property_read_u32_index(dn, "mstar,irqs-map-= range", 1, &irq_end)) > =C2=A0 return -EINVAL; > =C2=A0 > + if (irq_end < irq_start || > + =C2=A0=C2=A0=C2=A0 irq_end - irq_start >=3D MST_INTC_MAX_IRQS) > + return -EINVAL; > + > =C2=A0 cd =3D kzalloc_obj(*cd); > =C2=A0 if (!cd) > =C2=A0 return -ENOMEM; Reviewed-by: Radu Rendec