[PATCH 05/16] irqchip/bcm7038-l1: clean up init failure paths

[PATCH 05/16] irqchip/bcm7038-l1: clean up init failure paths

[Haofeng Li]

From: Haofeng Li <lihaofeng@kylinos.cn>

bcm7038_l1_init_one() stores the allocated CPU object in
intc->cpus[idx] before mapping its registers and parent interrupt.
Failures after that allocation leak the CPU object and possibly its
MMIO mapping.

A later IRQ domain allocation failure also frees intc while leaving
parent mappings and chained handlers installed for CPUs initialized
successfully. Those handlers retain intc as their data and can access
freed memory.

Free the current CPU object on local failures. Remember every parent
IRQ so the common error path can disable wake when it was enabled,
remove the chained handler, dispose the mapping, unmap the registers,
and free the CPU object before freeing intc.

Fixes: 5f7f0317ed28 ("IRQCHIP: Add new driver for BCM7038-style level 1 interrupt controllers")

Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
---
 drivers/irqchip/irq-bcm7038-l1.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
index 54a8557ef557..b42c4f4df6bf 100644
--- a/drivers/irqchip/irq-bcm7038-l1.c
+++ b/drivers/irqchip/irq-bcm7038-l1.c
@@ -49,6 +49,8 @@ struct bcm7038_l1_chip {
 
 struct bcm7038_l1_cpu {
 	void __iomem		*map_base;
+	unsigned int		parent_irq;
+	bool			wake_enabled;
 	u32			mask_cache[];
 };
 
@@ -247,8 +249,11 @@ static int bcm7038_l1_init_one(struct device_node *dn, unsigned int idx,
 		return -ENOMEM;
 
 	cpu->map_base = ioremap(res.start, sz);
-	if (!cpu->map_base)
+	if (!cpu->map_base) {
+		kfree(cpu);
+		intc->cpus[idx] = NULL;
 		return -ENOMEM;
+	}
 
 	for (i = 0; i < n_words; i++) {
 		l1_writel(~intc->irq_fwd_mask[i],
@@ -261,12 +266,17 @@ static int bcm7038_l1_init_one(struct device_node *dn, unsigned int idx,
 	parent_irq = irq_of_parse_and_map(dn, idx);
 	if (!parent_irq) {
 		pr_err("failed to map parent interrupt %d\n", parent_irq);
+		iounmap(cpu->map_base);
+		kfree(cpu);
+		intc->cpus[idx] = NULL;
 		return -EINVAL;
 	}
 
-	if (of_property_read_bool(dn, "brcm,irq-can-wake"))
-		enable_irq_wake(parent_irq);
+	if (of_property_read_bool(dn, "brcm,irq-can-wake") &&
+	    !enable_irq_wake(parent_irq))
+		cpu->wake_enabled = true;
 
+	cpu->parent_irq = parent_irq;
 	irq_set_chained_handler_and_data(parent_irq, bcm7038_l1_irq_handle,
 					 intc);
 
@@ -408,7 +418,7 @@ static int bcm7038_l1_probe(struct platform_device *pdev, struct device_node *pa
 			if (idx)
 				break;
 			pr_err("failed to remap intc L1 registers\n");
-			goto out_free;
+			goto out_unmap;
 		}
 	}
 
@@ -440,6 +450,12 @@ static int bcm7038_l1_probe(struct platform_device *pdev, struct device_node *pa
 		struct bcm7038_l1_cpu *cpu = intc->cpus[idx];
 
 		if (cpu) {
+			if (cpu->parent_irq) {
+				if (cpu->wake_enabled)
+					disable_irq_wake(cpu->parent_irq);
+				irq_set_chained_handler_and_data(cpu->parent_irq, NULL, NULL);
+				irq_dispose_mapping(cpu->parent_irq);
+			}
 			if (cpu->map_base)
 				iounmap(cpu->map_base);
 			kfree(cpu);
-- 
2.25.1

[PATCH 10/16] irqchip/aspeed-vic: publish handler only after domain creation

[Haofeng Li]

From: Haofeng Li <lihaofeng@kylinos.cn>

avic_of_init() publishes system_avic and installs the root IRQ
handler before creating the IRQ domain, then returns success even if
irq_domain_create_simple() fails.

Freeing the VIC after the root handler has been installed would leave
avic_handle_irq() pointing at a cleared or freed controller. Create
the domain first, then publish the controller and install the handler.
Also handle set_handle_irq() failure by removing the domain and
releasing all resources before the handler has been changed.

Fixes: 5952884258e5 ("irqchip/aspeed-vic: Add irq controller for Aspeed")

Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
---
 drivers/irqchip/irq-aspeed-vic.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/drivers/irqchip/irq-aspeed-vic.c b/drivers/irqchip/irq-aspeed-vic.c
index 6649b893f39c..bb3cceec375f 100644
--- a/drivers/irqchip/irq-aspeed-vic.c
+++ b/drivers/irqchip/irq-aspeed-vic.c
@@ -186,6 +186,7 @@ static int __init avic_of_init(struct device_node *node,
 {
 	void __iomem *regs;
 	struct aspeed_vic *vic;
+	int ret;
 
 	if (WARN(parent, "non-root Aspeed VIC not supported"))
 		return -EINVAL;
@@ -206,15 +207,29 @@ static int __init avic_of_init(struct device_node *node,
 	/* Initialize sources, all masked */
 	vic_init_hw(vic);
 
-	/* Ready to receive interrupts */
-	system_avic = vic;
-	set_handle_irq(avic_handle_irq);
-
 	/* Register our domain */
 	vic->dom = irq_domain_create_simple(of_fwnode_handle(node), NUM_IRQS, 0,
 					    &avic_dom_ops, vic);
+	if (!vic->dom) {
+		ret = -ENOMEM;
+		goto err_free_vic;
+	}
+
+	/* Ready to receive interrupts */
+	system_avic = vic;
+	ret = set_handle_irq(avic_handle_irq);
+	if (ret)
+		goto err_remove_domain;
 
 	return 0;
+
+err_remove_domain:
+	system_avic = NULL;
+	irq_domain_remove(vic->dom);
+err_free_vic:
+	iounmap(regs);
+	kfree(vic);
+	return ret;
 }
 
 IRQCHIP_DECLARE(ast2400_vic, "aspeed,ast2400-vic", avic_of_init);
-- 
2.25.1

[PATCH 15/16] irqchip/gic-v3: fail T241 quirk if alias ioremap fails

[Haofeng Li]

From: Haofeng Li <lihaofeng@kylinos.cn>

NVIDIA T241 GICD alias setup only warns about a failed ioremap, then
enables gic_nvidia_t241_erratum. Later accesses through the missing
alias can dereference NULL.

If any alias cannot be mapped, report which chip failed, unmap all
aliases created so far, and return without enabling the erratum static
key.

Fixes: 35727af2b15d ("irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4")

Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
---
 drivers/irqchip/irq-gic-v3.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 99444a1b2ffa..a8a395a98c09 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -1840,7 +1840,16 @@ static bool gic_enable_quirk_nvidia_t241(void *data)
 			phys = gic_data.dist_phys_base + T241_CHIP_GICDA_OFFSET;
 			phys |= FIELD_PREP(T241_CHIPN_MASK, i);
 			t241_dist_base_alias[i] = ioremap(phys, SZ_64K);
-			WARN_ON_ONCE(!t241_dist_base_alias[i]);
+			if (!t241_dist_base_alias[i]) {
+				pr_err("Failed to map NVIDIA T241 GICD alias for chip %u\n", i);
+				while (i--) {
+					if (t241_dist_base_alias[i]) {
+						iounmap(t241_dist_base_alias[i]);
+						t241_dist_base_alias[i] = NULL;
+					}
+				}
+				return false;
+			}
 		}
 	}
 	static_branch_enable(&gic_nvidia_t241_erratum);
-- 
2.25.1

Re: [PATCH 15/16] irqchip/gic-v3: fail T241 quirk if alias ioremap fails

[Marc Zyngier]

On Tue, 14 Jul 2026 14:24:51 +0100,
Haofeng Li <920484857@qq.com> wrote:
> 
> From: Haofeng Li <lihaofeng@kylinos.cn>
> 
> NVIDIA T241 GICD alias setup only warns about a failed ioremap, then
> enables gic_nvidia_t241_erratum. Later accesses through the missing
> alias can dereference NULL.

There won't be any later accesses, the machine is *dead*, short of
reliably handle interrupts. The only thing this patch is doing is
giving a false sense of having fixed something, while it is far worse
than the existing situation.

Please tell that to your LLM.

	M.

-- 
Without deviation from the norm, progress is not possible.

[PATCH 16/16] irqchip/bcm7120-l2: fix parent IRQ count error handling

[Haofeng Li]

From: Haofeng Li <lihaofeng@kylinos.cn>

When platform_irq_count() fails or returns zero, probe reported -ENOMEM
even though no memory allocation failed. Negative values such as
-EPROBE_DEFER were also discarded, which breaks deferred probe.

Propagate negative errno from platform_irq_count(), and return -EINVAL
only for a zero parent interrupt count.

Fixes: 3ac268d5ed22 ("irqchip/irq-bcm7120-l2: Switch to IRQCHIP_PLATFORM_DRIVER")
Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
---
 drivers/irqchip/irq-bcm7120-l2.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c
index a98f0ee46b6c..9f412c0be6d7 100644
--- a/drivers/irqchip/irq-bcm7120-l2.c
+++ b/drivers/irqchip/irq-bcm7120-l2.c
@@ -225,9 +225,13 @@ static int bcm7120_l2_intc_probe(struct platform_device *pdev, struct device_nod
 		return -ENOMEM;
 
 	data->num_parent_irqs = platform_irq_count(pdev);
-	if (data->num_parent_irqs <= 0) {
+	if (data->num_parent_irqs < 0) {
+		ret = data->num_parent_irqs;
+		goto out_unmap;
+	}
+	if (!data->num_parent_irqs) {
 		pr_err("invalid number of parent interrupts\n");
-		ret = -ENOMEM;
+		ret = -EINVAL;
 		goto out_unmap;
 	}
 
-- 
2.25.1