github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

irqchip/mst-intc: Validate the DT interrupt range

Browse Source 
The driver takes an inclusive interrupt range from the device tree
without checking its endpoints. A reversed range wraps the unsigned
count calculation, and a range larger than MST_INTC_MAX_IRQS exceeds the
controller capacity used by the driver.

Reject these ranges before calculating nr_irqs or creating the domain.
Check the difference after ordering the endpoints so the validation
itself cannot wrap.

The issue was found by our static-analysis tool.

Fixes: ad4c938c92 ("irqchip/irq-mst: Add MStar interrupt controller support")
Signed-off-by: Pengpeng Hou <hppiscas@163.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: gpt 5
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260920034236.16229-1-hppiscas@163.com
This commit is contained in:
Pengpeng Hou 2026-09-20 11:42:36 +08:00 committed by Thomas Gleixner
parent e571b39ded
commit 16f25d326e
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/irqchip/irq-mst-intc.c
View File

@ -263,6 +263,9 @@ static int __init mst_intc_of_init(struct device_node *dn,
of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end))
return -EINVAL;
if (irq_end < irq_start || irq_end - irq_start >= MST_INTC_MAX_IRQS)
return -EINVAL;
cd = kzalloc_obj(*cd);
if (!cd)
return -ENOMEM;