From 16f25d326e5d3b9fd51bc5e3916ecbffbca63e7b Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Sun, 20 Sep 2026 11:42:36 +0800 Subject: [PATCH] irqchip/mst-intc: Validate the DT interrupt range The driver takes an inclusive interrupt range from the device tree without checking its endpoints. A reversed range wraps the unsigned count calculation, and a range larger than MST_INTC_MAX_IRQS exceeds the controller capacity used by the driver. Reject these ranges before calculating nr_irqs or creating the domain. Check the difference after ordering the endpoints so the validation itself cannot wrap. The issue was found by our static-analysis tool. Fixes: ad4c938c92af ("irqchip/irq-mst: Add MStar interrupt controller support") Signed-off-by: Pengpeng Hou Signed-off-by: Thomas Gleixner Assisted-by: gpt 5 Reviewed-by: Radu Rendec Link: https://patch.msgid.link/20260920034236.16229-1-hppiscas@163.com --- drivers/irqchip/irq-mst-intc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c index b5335f6fd6d6..1070de5de8cc 100644 --- a/drivers/irqchip/irq-mst-intc.c +++ b/drivers/irqchip/irq-mst-intc.c @@ -263,6 +263,9 @@ static int __init mst_intc_of_init(struct device_node *dn, of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end)) return -EINVAL; + if (irq_end < irq_start || irq_end - irq_start >= MST_INTC_MAX_IRQS) + return -EINVAL; + cd = kzalloc_obj(*cd); if (!cd) return -ENOMEM;