From d09b36d8e0e60f35bd1cd7d63aadc6dfad61700c Mon Sep 17 00:00:00 2001 From: Fuad Tabba Date: Fri, 25 Sep 2026 09:49:59 +0100 Subject: [PATCH] irqchip/gic-v3-its: Don't free the tables of an enabled ITS its_probe_one() enables the ITS before its_init_domain(), the last step that can fail, and the unwind from there frees the tables and the command queue without disabling it. The kernel comes up with an enabled ITS pointing at freed pages. Enable the ITS last. Nothing reaches the new domain before then: this runs from init_IRQ(), and the ITS joins its_nodes only after the enable. Fixes: 4c21f3c26ecc2 ("irqchip: GICv3: ITS: DT probing and initialization") Signed-off-by: Fuad Tabba Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Link: https://patch.msgid.link/20260925085000.753400-3-fuad.tabba@linux.dev --- drivers/irqchip/irq-gic-v3-its.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 259ec0ca3d1b..282e4bafb084 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -5337,16 +5337,18 @@ static int __init its_probe_one(struct its_node *its) } gits_write_cwriter(0, its->base + GITS_CWRITER); + + err = its_init_domain(its); + if (err) + goto out_free_collection; + + /* Enable last: the unwind frees memory an enabled ITS may access */ ctlr = readl_relaxed(its->base + GITS_CTLR); ctlr |= GITS_CTLR_ENABLE; if (is_v4(its)) ctlr |= GITS_CTLR_ImDe; writel_relaxed(ctlr, its->base + GITS_CTLR); - err = its_init_domain(its); - if (err) - goto out_free_collection; - raw_spin_lock(&its_lock); list_add(&its->entry, &its_nodes); raw_spin_unlock(&its_lock);