From 135d9e67f7ab4f261c2157ee2de1f93a4de39a41 Mon Sep 17 00:00:00 2001 From: Karl Mehltretter Date: Tue, 11 Aug 2026 11:55:32 +0200 Subject: [PATCH] irqchip/gic-v3-its: Don't WARN on LPI free allocation failure free_lpi_range() cannot give LPIs back to the allocator without allocating a struct lpi_range to describe the freed range, so it returns -ENOMEM (its only failure mode) when that allocation fails, and its_lpi_free() turns this into a WARN_ON(). syzbot triggers the WARN_ON() by injecting a slab allocation failure on device teardown, which with panic_on_warn becomes a panic: WARNING: drivers/irqchip/irq-gic-v3-its.c:2251 at its_msi_teardown+0x3a4/0x424 its_msi_teardown+0x3a4/0x424 msi_remove_device_irq_domain+0x16c/0x27c msi_device_data_release+0x38/0x9c The failure is transient and the consequence benign: the freed range is simply never returned to the allocator. This does not warrant a WARN_ON() backtrace, so log a rate-limited error instead. Fixes: 880cb3cddd16 ("irqchip/gic-v3-its: Refactor LPI allocator") Reported-by: syzbot+229d761b8a110e6de517@syzkaller.appspotmail.com Signed-off-by: Karl Mehltretter Signed-off-by: Thomas Gleixner Assisted-by: Claude:claude-fable-5 Link: https://patch.msgid.link/20260811095532.48454-1-kmehltretter@gmail.com Closes: https://syzkaller.appspot.com/bug?extid=229d761b8a110e6de517 --- drivers/irqchip/irq-gic-v3-its.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index e9807af23537..b0fdc2b42a22 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -2248,7 +2248,8 @@ static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids) static void its_lpi_free(unsigned long *bitmap, u32 base, u32 nr_ids) { - WARN_ON(free_lpi_range(base, nr_ids)); + if (free_lpi_range(base, nr_ids)) + pr_err_ratelimited("ITS: failed to free LPI range %u:%u\n", base, nr_ids); bitmap_free(bitmap); }