From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.mindbit.ro (xs1.mindbit.ro [80.86.107.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 671772773D8 for ; Sat, 25 Jul 2026 16:13:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=80.86.107.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784996008; cv=none; b=RuvXhv4lbnAhf4OqpyRM1lh38J3XfKVqr20orD4x2OOIZGnefVfB0869j6BLTSCdaVRnXBdS7v/PxdkkuidkhKCDvlV3KIYUIPgubJwa6cNhNHMsCMPiwWQ8JfS2lzGZIxPrQFZPBVKTBUaJfmU6edxNHnVABHn6dmvBDCouSvI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784996008; c=relaxed/simple; bh=0HHxJswlMwgRC5Vq8b6zvrfqWZ1if5FDZ7+J+LpNeqQ=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=N4wcymtU5LCQWx45snPYAt1iDjdq285CqRuA4uNozgv8tBHY2jDaSBjNIoC5zwjSKTs5+dUzmnwe4kLntulwDrvovXUfSmocgjj1knJfoR6XvPaxIGlDde+6GHZZO6dto0hnGEIjqnYp/ulfUTzK9lWkrDJJ0Aw9PHikkmSPvR0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=rendec.net; spf=pass smtp.mailfrom=rendec.net; dkim=pass (2048-bit key) header.d=rendec.net header.i=@rendec.net header.b=hOU8HOw4; arc=none smtp.client-ip=80.86.107.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=rendec.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=rendec.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=rendec.net header.i=@rendec.net header.b="hOU8HOw4" Received: from dog.kanata.rendec.net (pool-174-112-193-187.cpe.net.cable.rogers.com [174.112.193.187]) by mail.mindbit.ro (Postfix) with ESMTPSA id E7E86C289F; Sat, 25 Jul 2026 19:13:21 +0300 (EEST) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.mindbit.ro E7E86C289F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rendec.net; s=default; t=1784996003; bh=YI32JWrMTg8CystnwVwPIZbj+64IR2ZStKiHxrt8NMk=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=hOU8HOw48svZKptUQRFuMvQJ0atEuRvEQEBVEhjdV4kHqq7HWn05uv6Gi4yNYKCC6 8o2Sv9+zu5uxdI3E+M/GRxj1oo15iW/kpRSurmGoLuTaoOtW4OO2PTNxdzFCpbZEGI E61lCiyX715tyqEg1Iht7msBmaU/nTqZ27lnmKIIlXId5rwPZtW+LPm3Z619z9NE5H N/yKz9o/ewdh8gf+QB44uCD7PtmDpr/8ABG/zJC4hky5i9xNzXntIqyLWDSU7ABfn2 jToMNLcZvVku5mviq1KZUehJbr6Y78HJUlmQz++iO4KtbDAmXWzc9QILwisyiS5NYm wLOr0U8gMdStw== Message-ID: <7a124c80a48d2ada6ad21c1ac27e9fd888ae1a56.camel@rendec.net> Subject: Re: [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup From: Radu Rendec To: Haofeng Li , tglx@kernel.org Cc: linux-kernel@vger.kernel.org, Haofeng Li <13266079573@163.com>, Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , =?ISO-8859-1?Q?Bj=F6rn_T=F6pel?= , linux-riscv@lists.infradead.org Date: Sat, 25 Jul 2026 12:13:20 -0400 In-Reply-To: <20260714122351.3274006-2-lihaofeng@kylinos.cn> References: <20260714122351.3274006-1-lihaofeng@kylinos.cn> <20260714122351.3274006-2-lihaofeng@kylinos.cn> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.3 (3.58.3-1.fc43) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Tue, 2026-07-14 at 20:23 +0800, Haofeng Li wrote: > The MSI page lookup loop uses: >=20 > for (j =3D 0; nr_mmios; j++) >=20 > When nr_mmios is non-zero the condition is always true, so j is never > bounded. If reloff does not fall in any MMIO region the loop indexes > past mmios[] and may hang or fault. >=20 > Also, mmios_va starts as NULL. If its allocation fails, the out_iounmap > path indexes mmios_va[i] and NULL-dereferences. >=20 > Bound the loop with j < nr_mmios, and guard the iounmap/kfree cleanup > with if (mmios_va). >=20 > Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early d= river") > Signed-off-by: Haofeng Li > --- > =C2=A0drivers/irqchip/irq-riscv-imsic-state.c | 12 +++++++----- > =C2=A01 file changed, 7 insertions(+), 5 deletions(-) >=20 > diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/ir= q-riscv-imsic-state.c > index b8d1bbbf42f7..19f74cf79988 100644 > --- a/drivers/irqchip/irq-riscv-imsic-state.c > +++ b/drivers/irqchip/irq-riscv-imsic-state.c > @@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fw= node, void *opaque) > =C2=A0 index =3D nr_mmios; > =C2=A0 reloff =3D i * BIT(global->guest_index_bits) * > =C2=A0 IMSIC_MMIO_PAGE_SZ; > - for (j =3D 0; nr_mmios; j++) { > + for (j =3D 0; j < nr_mmios; j++) { > =C2=A0 if (reloff < resource_size(&mmios[j])) { > =C2=A0 index =3D j; > =C2=A0 break; > @@ -953,11 +953,13 @@ int __init imsic_setup_state(struct fwnode_handle *= fwnode, void *opaque) > =C2=A0out_local_cleanup: > =C2=A0 imsic_local_cleanup(); > =C2=A0out_iounmap: > - for (i =3D 0; i < nr_mmios; i++) { > - if (mmios_va[i]) > - iounmap(mmios_va[i]); > + if (mmios_va) { > + for (i =3D 0; i < nr_mmios; i++) { > + if (mmios_va[i]) > + iounmap(mmios_va[i]); > + } > + kfree(mmios_va); > =C2=A0 } > - kfree(mmios_va); > =C2=A0 kfree(mmios); > =C2=A0out_free_local: > =C2=A0 free_percpu(imsic->global.local); Reviewed-by: Radu Rendec From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E4B80C531D0 for ; Sat, 25 Jul 2026 16:13:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Date:Cc:To:From:Subject:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=nc17IzCzycBbnFYHT67IG7lZ/5yH9Du8IiHMR4LPdSc=; b=t6t8KW/AZ8GHPR RlpyyRkaVuAIS7mx0eCHdhu50sZgawwZnyok1GYVt38n6K1UnUFISvhekX9PabdHUqVSc6G1e64Wi oE7m17DxcxOlSJz07KDsMgqne9UaUCBE+gPq6DXIEx1RgA8QePSpXIie9OOF/xkmN24stjtjpdTu5 BN3pORjhziMdV8T3dBzeHEDENFU265wa6PSqAn32GJumEQMN4ujKODIgTnRxYhLHxyRq+WAjmAJLx SqIPn8++TW7zAxhk8xb38xGcavPDQ7jz0GotOQapuansmZ3gGfosuD1HEMWwLClvyBSs6SPrM19xS 9AFRPtCW5BuU611A4RDA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wnf0D-00000000W0d-3fMw; Sat, 25 Jul 2026 16:13:29 +0000 Received: from xs1.mindbit.ro ([80.86.107.70] helo=mail.mindbit.ro) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wnf09-00000000W0F-3pDX for linux-riscv@lists.infradead.org; Sat, 25 Jul 2026 16:13:28 +0000 Received: from dog.kanata.rendec.net (pool-174-112-193-187.cpe.net.cable.rogers.com [174.112.193.187]) by mail.mindbit.ro (Postfix) with ESMTPSA id E7E86C289F; Sat, 25 Jul 2026 19:13:21 +0300 (EEST) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.mindbit.ro E7E86C289F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rendec.net; s=default; t=1784996003; bh=YI32JWrMTg8CystnwVwPIZbj+64IR2ZStKiHxrt8NMk=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=hOU8HOw48svZKptUQRFuMvQJ0atEuRvEQEBVEhjdV4kHqq7HWn05uv6Gi4yNYKCC6 8o2Sv9+zu5uxdI3E+M/GRxj1oo15iW/kpRSurmGoLuTaoOtW4OO2PTNxdzFCpbZEGI E61lCiyX715tyqEg1Iht7msBmaU/nTqZ27lnmKIIlXId5rwPZtW+LPm3Z619z9NE5H N/yKz9o/ewdh8gf+QB44uCD7PtmDpr/8ABG/zJC4hky5i9xNzXntIqyLWDSU7ABfn2 jToMNLcZvVku5mviq1KZUehJbr6Y78HJUlmQz++iO4KtbDAmXWzc9QILwisyiS5NYm wLOr0U8gMdStw== Message-ID: <7a124c80a48d2ada6ad21c1ac27e9fd888ae1a56.camel@rendec.net> Subject: Re: [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup From: Radu Rendec To: Haofeng Li , tglx@kernel.org Cc: linux-kernel@vger.kernel.org, Haofeng Li <13266079573@163.com>, Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , =?ISO-8859-1?Q?Bj=F6rn_T=F6pel?= , linux-riscv@lists.infradead.org Date: Sat, 25 Jul 2026 12:13:20 -0400 In-Reply-To: <20260714122351.3274006-2-lihaofeng@kylinos.cn> References: <20260714122351.3274006-1-lihaofeng@kylinos.cn> <20260714122351.3274006-2-lihaofeng@kylinos.cn> User-Agent: Evolution 3.58.3 (3.58.3-1.fc43) MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260725_091326_398430_BDF4609F X-CRM114-Status: GOOD ( 14.08 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org T24gVHVlLCAyMDI2LTA3LTE0IGF0IDIwOjIzICswODAwLCBIYW9mZW5nIExpIHdyb3RlOgo+IFRo ZSBNU0kgcGFnZSBsb29rdXAgbG9vcCB1c2VzOgo+IAo+IAlmb3IgKGogPSAwOyBucl9tbWlvczsg aisrKQo+IAo+IFdoZW4gbnJfbW1pb3MgaXMgbm9uLXplcm8gdGhlIGNvbmRpdGlvbiBpcyBhbHdh eXMgdHJ1ZSwgc28gaiBpcyBuZXZlcgo+IGJvdW5kZWQuIElmIHJlbG9mZiBkb2VzIG5vdCBmYWxs IGluIGFueSBNTUlPIHJlZ2lvbiB0aGUgbG9vcCBpbmRleGVzCj4gcGFzdCBtbWlvc1tdIGFuZCBt YXkgaGFuZyBvciBmYXVsdC4KPiAKPiBBbHNvLCBtbWlvc192YSBzdGFydHMgYXMgTlVMTC4gSWYg aXRzIGFsbG9jYXRpb24gZmFpbHMsIHRoZSBvdXRfaW91bm1hcAo+IHBhdGggaW5kZXhlcyBtbWlv c192YVtpXSBhbmQgTlVMTC1kZXJlZmVyZW5jZXMuCj4gCj4gQm91bmQgdGhlIGxvb3Agd2l0aCBq IDwgbnJfbW1pb3MsIGFuZCBndWFyZCB0aGUgaW91bm1hcC9rZnJlZSBjbGVhbnVwCj4gd2l0aCBp ZiAobW1pb3NfdmEpLgo+IAo+IEZpeGVzOiAyMWE4ZjhhMGViMzUgKCJpcnFjaGlwOiBBZGQgUklT Qy1WIGluY29taW5nIE1TSSBjb250cm9sbGVyIGVhcmx5IGRyaXZlciIpCj4gU2lnbmVkLW9mZi1i eTogSGFvZmVuZyBMaSA8bGloYW9mZW5nQGt5bGlub3MuY24+Cj4gLS0tCj4gwqBkcml2ZXJzL2ly cWNoaXAvaXJxLXJpc2N2LWltc2ljLXN0YXRlLmMgfCAxMiArKysrKysrLS0tLS0KPiDCoDEgZmls ZSBjaGFuZ2VkLCA3IGluc2VydGlvbnMoKyksIDUgZGVsZXRpb25zKC0pCj4gCj4gZGlmZiAtLWdp dCBhL2RyaXZlcnMvaXJxY2hpcC9pcnEtcmlzY3YtaW1zaWMtc3RhdGUuYyBiL2RyaXZlcnMvaXJx Y2hpcC9pcnEtcmlzY3YtaW1zaWMtc3RhdGUuYwo+IGluZGV4IGI4ZDFiYmJmNDJmNy4uMTlmNzRj Zjc5OTg4IDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvaXJxY2hpcC9pcnEtcmlzY3YtaW1zaWMtc3Rh dGUuYwo+ICsrKyBiL2RyaXZlcnMvaXJxY2hpcC9pcnEtcmlzY3YtaW1zaWMtc3RhdGUuYwo+IEBA IC04OTYsNyArODk2LDcgQEAgaW50IF9faW5pdCBpbXNpY19zZXR1cF9zdGF0ZShzdHJ1Y3QgZndu b2RlX2hhbmRsZSAqZndub2RlLCB2b2lkICpvcGFxdWUpCj4gwqAJCWluZGV4ID0gbnJfbW1pb3M7 Cj4gwqAJCXJlbG9mZiA9IGkgKiBCSVQoZ2xvYmFsLT5ndWVzdF9pbmRleF9iaXRzKSAqCj4gwqAJ CQkgSU1TSUNfTU1JT19QQUdFX1NaOwo+IC0JCWZvciAoaiA9IDA7IG5yX21taW9zOyBqKyspIHsK PiArCQlmb3IgKGogPSAwOyBqIDwgbnJfbW1pb3M7IGorKykgewo+IMKgCQkJaWYgKHJlbG9mZiA8 IHJlc291cmNlX3NpemUoJm1taW9zW2pdKSkgewo+IMKgCQkJCWluZGV4ID0gajsKPiDCoAkJCQli cmVhazsKPiBAQCAtOTUzLDExICs5NTMsMTMgQEAgaW50IF9faW5pdCBpbXNpY19zZXR1cF9zdGF0 ZShzdHJ1Y3QgZndub2RlX2hhbmRsZSAqZndub2RlLCB2b2lkICpvcGFxdWUpCj4gwqBvdXRfbG9j YWxfY2xlYW51cDoKPiDCoAlpbXNpY19sb2NhbF9jbGVhbnVwKCk7Cj4gwqBvdXRfaW91bm1hcDoK PiAtCWZvciAoaSA9IDA7IGkgPCBucl9tbWlvczsgaSsrKSB7Cj4gLQkJaWYgKG1taW9zX3ZhW2ld KQo+IC0JCQlpb3VubWFwKG1taW9zX3ZhW2ldKTsKPiArCWlmIChtbWlvc192YSkgewo+ICsJCWZv ciAoaSA9IDA7IGkgPCBucl9tbWlvczsgaSsrKSB7Cj4gKwkJCWlmIChtbWlvc192YVtpXSkKPiAr CQkJCWlvdW5tYXAobW1pb3NfdmFbaV0pOwo+ICsJCX0KPiArCQlrZnJlZShtbWlvc192YSk7Cj4g wqAJfQo+IC0Ja2ZyZWUobW1pb3NfdmEpOwo+IMKgCWtmcmVlKG1taW9zKTsKPiDCoG91dF9mcmVl X2xvY2FsOgo+IMKgCWZyZWVfcGVyY3B1KGltc2ljLT5nbG9iYWwubG9jYWwpOwoKUmV2aWV3ZWQt Ynk6IFJhZHUgUmVuZGVjIDxyYWR1QHJlbmRlYy5uZXQ+CgpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fXwpsaW51eC1yaXNjdiBtYWlsaW5nIGxpc3QKbGludXgt cmlzY3ZAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWls bWFuL2xpc3RpbmZvL2xpbnV4LXJpc2N2Cg==