From 13ce14ca41a35f5ee90b77ffa57da91ce6048a2d Mon Sep 17 00:00:00 2001 From: Zhu Ling Date: Tue, 29 Sep 2026 11:10:50 +0800 Subject: [PATCH] irqchip/gic: Fix UBSAN shift-out-of-bounds in GIC helpers When running with UBSAN enabled, enabling a GPIO controller that uses a GIC interrupt as its parent triggers several shift-out-of-bounds warnings: shift-out-of-bounds in drivers/irqchip/irq-gic-common.c:50:21 left shift of 2 by 30 places cannot be represented in type 'int' Similar reports are emitted from gic_poke_irq() and gic_peek_irq() in drivers/irqchip/irq-gic-v3.c. The corresponding GICv2 helpers use the same signed-shift pattern. These masks are generated by shifting signed integer constants, which invokes undefined behavior when bit 31 is selected. Use BIT() to generate the masks with an unsigned type and make their intent explicit. Fixes: f27ecacc54cc ("[ARM] Add support for ARM GIC") Fixes: 5c0c1f08abf0 ("ARM: 6150/1: gic: implement set_type") Fixes: 021f653791ad ("irqchip: gic-v3: Initial support for GICv3") Signed-off-by: Zhu Ling Signed-off-by: Thomas Gleixner Reviewed-by: Zenghui Yu (Huawei) Reviewed-by: Radu Rendec Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/2fJDwUUYdEf2_eaRa041L9xkT8RkSWFeo7euOnqMbbPhUatLlEaAvGfB6sOspDmXaxO87Eh7bQLV9UolyjbMtZBT1wB2UGypjPOo0Z-RC0Q=@proton.me Link: https://patch.msgid.link/20260929031050.16988-1-zhuling2709@phytium.com.cn --- drivers/irqchip/irq-gic-common.c | 2 +- drivers/irqchip/irq-gic-v3.c | 4 ++-- drivers/irqchip/irq-gic.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/irqchip/irq-gic-common.c b/drivers/irqchip/irq-gic-common.c index c776f9142610..8bd1eaa54295 100644 --- a/drivers/irqchip/irq-gic-common.c +++ b/drivers/irqchip/irq-gic-common.c @@ -48,7 +48,7 @@ void gic_enable_quirks(u32 iidr, const struct gic_quirk *quirks, int gic_configure_irq(unsigned int irq, unsigned int type, void __iomem *base) { - u32 confmask = 0x2 << ((irq % 16) * 2); + u32 confmask = BIT(((irq % 16) * 2) + 1); u32 confoff = (irq / 16) * 4; u32 val, oldval; int ret = 0; diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index 32a8ea4065cc..b9a99f96ff25 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -457,7 +457,7 @@ static int gic_peek_irq(struct irq_data *d, u32 offset) u32 index, mask; offset = convert_offset_index(d, offset, &index); - mask = 1 << (index % 32); + mask = BIT(index % 32); if (gic_irq_in_rdist(d)) base = gic_data_rdist_sgi_base(); @@ -473,7 +473,7 @@ static void gic_poke_irq(struct irq_data *d, u32 offset) u32 index, mask; offset = convert_offset_index(d, offset, &index); - mask = 1 << (index % 32); + mask = BIT(index % 32); if (gic_irq_in_rdist(d)) base = gic_data_rdist_sgi_base(); diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c index b2926a3ddaf1..a5ca04e9be64 100644 --- a/drivers/irqchip/irq-gic.c +++ b/drivers/irqchip/irq-gic.c @@ -178,14 +178,14 @@ static inline bool cascading_gic_irq(struct irq_data *d) */ static void gic_poke_irq(struct irq_data *d, u32 offset) { - u32 mask = 1 << (irqd_to_hwirq(d) % 32); + u32 mask = BIT(irqd_to_hwirq(d) % 32); writel_relaxed(mask, gic_dist_base(d) + offset + (irqd_to_hwirq(d) / 32) * 4); } static int gic_peek_irq(struct irq_data *d, u32 offset) { - u32 mask = 1 << (irqd_to_hwirq(d) % 32); + u32 mask = BIT(irqd_to_hwirq(d) % 32); return !!(readl_relaxed(gic_dist_base(d) + offset + (irqd_to_hwirq(d) / 32) * 4) & mask); }