From 6a21693b97ee5cb0a21d04bfd051a05dde5aa783 Mon Sep 17 00:00:00 2001 From: Fuad Tabba Date: Fri, 25 Sep 2026 09:50:00 +0100 Subject: [PATCH] irqchip/gic-v3: Don't register a redistributor that was never counted gic_acpi_match_gicc() counts only the enabled GICCs with a non-zero gicr_base_address, and that count sizes redist_regs[], but gic_acpi_parse_madt_gicc() registers every enabled one. On a MADT with no GICR entries, an enabled GICC with a zero GICR base therefore makes gic_acpi_register_redist() write a struct redist_region past the end of the array. Commit fa2dabe57220e ("irqchip/gic-v3: Don't return errors from gic_acpi_match_gicc()") removed the check that kept the two consistent. Its message says such entries are still caught by gic_populate_rdist(), but that runs from gic_cpu_init(), after the write. Skip the entry instead, and mark the CPU's redistributor broken as the online-capable path does, so that gic_check_rdist() rejects the CPU. gic_starting_cpu() runs past cpuhp's last failure point, so without the mark the CPU would come online with its redistributor and CPU interface unconfigured. With an ITS, its_cpu_init() would then dereference a NULL rd_base. Fixes: fa2dabe57220e ("irqchip/gic-v3: Don't return errors from gic_acpi_match_gicc()") Signed-off-by: Fuad Tabba Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Link: https://patch.msgid.link/20260925085000.753400-4-fuad.tabba@linux.dev --- drivers/irqchip/irq-gic-v3.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index 9231688c9fa0..32a8ea4065cc 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -2344,6 +2344,17 @@ gic_acpi_parse_madt_gicc(union acpi_subtable_headers *header, return 0; } + /* Not counted by gic_acpi_match_gicc(), so there is no slot for it */ + if (!gicc->gicr_base_address) { + int cpu = get_cpu_for_acpi_id(gicc->uid); + + pr_warn(FW_BUG "GICC entry with ACPI UID %u has no GICR base address, CPU kept offline\n", + gicc->uid); + if (cpu >= 0) + cpumask_set_cpu(cpu, &broken_rdists); + return 0; + } + redist_base = ioremap(gicc->gicr_base_address, size); if (!redist_base) return -ENOMEM;