[PATCH] irqchip/mst-intc: reject ranges beyond saved state capacity

[Pengpeng Hou <pengpeng@iscas.ac.cn>]

The inclusive Device Tree IRQ range determines nr_irqs. Suspend and
resume then use nr_irqs to walk the fixed saved_status array, which has
MST_INTC_MAX_IRQS entries. A descending range underflows the unsigned
subtraction, while a range wider than 64 entries exceeds that array.

Reject both forms before deriving nr_irqs.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/irqchip/irq-mst-intc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c
index b5335f6fd6d6..1475335d668d 100644
--- a/drivers/irqchip/irq-mst-intc.c
+++ b/drivers/irqchip/irq-mst-intc.c
@@ -263,6 +263,10 @@ static int __init mst_intc_of_init(struct device_node *dn,
 	    of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end))
 		return -EINVAL;
 
+	if (irq_end < irq_start ||
+	    irq_end - irq_start >= MST_INTC_MAX_IRQS)
+		return -EINVAL;
+
 	cd = kzalloc_obj(*cd);
 	if (!cd)
 		return -ENOMEM;
-- 
2.43.0