[PATCH] irqchip/mst-intc: reject ranges beyond saved state capacity

[PATCH] irqchip/mst-intc: reject ranges beyond saved state capacity

[Pengpeng Hou]

The inclusive Device Tree IRQ range determines nr_irqs. Suspend and
resume then use nr_irqs to walk the fixed saved_status array, which has
MST_INTC_MAX_IRQS entries. A descending range underflows the unsigned
subtraction, while a range wider than 64 entries exceeds that array.

Reject both forms before deriving nr_irqs.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/irqchip/irq-mst-intc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c
index b5335f6fd6d6..1475335d668d 100644
--- a/drivers/irqchip/irq-mst-intc.c
+++ b/drivers/irqchip/irq-mst-intc.c
@@ -263,6 +263,10 @@ static int __init mst_intc_of_init(struct device_node *dn,
 	    of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end))
 		return -EINVAL;
 
+	if (irq_end < irq_start ||
+	    irq_end - irq_start >= MST_INTC_MAX_IRQS)
+		return -EINVAL;
+
 	cd = kzalloc_obj(*cd);
 	if (!cd)
 		return -ENOMEM;
-- 
2.43.0

Re: [PATCH] irqchip/mst-intc: reject ranges beyond saved state capacity

[Radu Rendec]

On Wed, 2026-07-22 at 12:14 +0800, Pengpeng Hou wrote:
> The inclusive Device Tree IRQ range determines nr_irqs. Suspend and
> resume then use nr_irqs to walk the fixed saved_status array, which has
> MST_INTC_MAX_IRQS entries. A descending range underflows the unsigned
> subtraction, while a range wider than 64 entries exceeds that array.
> 
> Reject both forms before deriving nr_irqs.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/irqchip/irq-mst-intc.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c
> index b5335f6fd6d6..1475335d668d 100644
> --- a/drivers/irqchip/irq-mst-intc.c
> +++ b/drivers/irqchip/irq-mst-intc.c
> @@ -263,6 +263,10 @@ static int __init mst_intc_of_init(struct device_node *dn,
>  	    of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end))
>  		return -EINVAL;
>  
> +	if (irq_end < irq_start ||
> +	    irq_end - irq_start >= MST_INTC_MAX_IRQS)
> +		return -EINVAL;
> +
>  	cd = kzalloc_obj(*cd);
>  	if (!cd)
>  		return -ENOMEM;

Reviewed-by: Radu Rendec <radu@rendec.net>

Re: [PATCH] irqchip/mst-intc: reject ranges beyond saved state capacity

[Thomas Gleixner]

On Wed, Jul 22 2026 at 12:14, Pengpeng Hou wrote:
> The inclusive Device Tree IRQ range determines nr_irqs. Suspend and
> resume then use nr_irqs to walk the fixed saved_status array, which has
> MST_INTC_MAX_IRQS entries. A descending range underflows the unsigned
> subtraction, while a range wider than 64 entries exceeds that array.

TBH, this is confusing at best. The problem is not the suspend/resume
implication. The problem is that there is no validation of start/end to
begin with. Whether that causes an out of bounds access somewhere down
the road is immaterial. 

> Reject both forms before deriving nr_irqs.

Both forms of what?

Something like this:

  The interrupt range for the driver is retrieved from the device tree,
  but lacks any form of validation.

  As a consequence a malformed device tree can result in out of bound
  accesses when the range exceeds MST_INTC_MAX_IRQS.

  Add the missing sanity checks.

> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

Lacks a "Fixes:" tag.

> ---
>  drivers/irqchip/irq-mst-intc.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c
> index b5335f6fd6d6..1475335d668d 100644
> --- a/drivers/irqchip/irq-mst-intc.c
> +++ b/drivers/irqchip/irq-mst-intc.c
> @@ -263,6 +263,10 @@ static int __init mst_intc_of_init(struct device_node *dn,
>  	    of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end))
>  		return -EINVAL;
>  
> +	if (irq_end < irq_start ||
> +	    irq_end - irq_start >= MST_INTC_MAX_IRQS)

No line break required.

> +		return -EINVAL;
> +
>  	cd = kzalloc_obj(*cd);
>  	if (!cd)
>  		return -ENOMEM;