[PATCH v2 0/3] irqchip/gic-v3: Memory-safety fixes on the probe paths

[Fuad Tabba <fuad.tabba@linux.dev>]

Hi folks,

Changes since v1 [1]:
  - Patch 3 marks the skipped CPU in broken_rdists, so it's kept
    offline. (Marc, sashiko)

Three probe-time bugs in the GICv3 drivers. The kernel keeps running
after each of them, so the memory involved is live rather than on the
way to a reset.

The first two free memory an enabled ITS still points at. Boot carries
on because its_init() discards a failed probe and gic_init_bases()
discards what its_init() returns. The third is a write past the end of
redist_regs[] for an enabled GICC with a zero GICR base, on a MADT with
no GICR entries. fa2dabe57220e's commit message says such tables exist,
and I haven't seen one.

Based on Linux 7.3-rc4 (93f51579e7df2).

Cheers,
/fuad

[1] https://lore.kernel.org/all/20260924161514.1112730-1-fuad.tabba@linux.dev/

Fuad Tabba (3):
  irqchip/gic-v3-its: Don't free a vPE table shared with another ITS
  irqchip/gic-v3-its: Don't free the tables of an enabled ITS
  irqchip/gic-v3: Don't register a redistributor that was never counted

 drivers/irqchip/irq-gic-v3-its.c | 16 +++++++++++-----
 drivers/irqchip/irq-gic-v3.c     | 11 +++++++++++
 2 files changed, 22 insertions(+), 5 deletions(-)


base-commit: 93f51579e7df248780214094418f205253383cc5
-- 
2.39.5