From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8052E3644B3; Tue, 21 Jul 2026 19:56:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784663812; cv=none; b=W5C9CR+4ZXEVLLsaL4dQjwHF0PX0Hm0yiN9Jmx0Ycn5naCCMyhPNjAEe0CnPDNQ9E+EHRRJ/G00playUUDF0MUw3XKw6LC2/fb2Vs6Djq/nprIgYqfdA+2m4n1cWbCQCo8iAMtLX7RrjLzyLYKp4ry0j+a30dlfZzhQL+52DLSA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784663812; c=relaxed/simple; bh=9pgZq2caBPycT1sgqUljw3D77ckdyqdNzhd/L+I1/sw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZDVKEAj/0lWfjMq2yi0f4FgAp5HUJWKE9JyiAZTSqURzVFpMQc/wgP6TPAB86roeP81pXkKmvfqPbDf4MBNmz9Xuqq7Q4/Z/58TFy9kMgDBkV2okvw9Gwpi7+jgNzSG80nttVSeAt+rFR21YeoZ4NtNSukUdWahnJaIBIku4DO0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jiQZAY2F; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="jiQZAY2F" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90E1C1F000E9; Tue, 21 Jul 2026 19:56:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784663811; bh=ZLNCRpHRtlPYBNsPKyyec8QnrOJJXqMlF4Hp/p/iPB0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jiQZAY2F+Tvb/XtY0QzvzkwZLDeLU3a0oan8UJ1PwI3FT/2ta6j1wpRy86RvMmKdM 7d6Mp8FHfNi0KoXJMdmm+XYCcAFDz85h1N4nSUN/+2XLty2oD7meafLqYGJFwYhSCb x56Pwe9nAjePhy+sqiBkCfu1hxhSm5YhxCHrvFQw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Bhargav Joshi , Thomas Gleixner Subject: [PATCH 6.12 0962/1276] irqchip/crossbar: Use correct index in crossbar_domain_free() Date: Tue, 21 Jul 2026 17:23:25 +0200 Message-ID: <20260721152507.554169761@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152446.065700225@linuxfoundation.org> References: <20260721152446.065700225@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bhargav Joshi commit 043db005a8d6932dc7d217c86307e9af0bc10ddc upstream. crossbar_domain_free() resets the domain data and then uses the nulled out irq_data->hwirq member as index to reset the irq_map[] entry and to write the relevant crossbar register with a safe entry. That means it never frees the correct index and keeps the crossbar register connection to the source interrupt active. If it would not reset the domain data, then this would be even worse as irq_data->hwirq holds the source interrupt number, but both the map and register index need the corresponding GIC SPI number and not the source interrupt number. This might even result in an out of bounds access as the source interrupt number can be higher than the maximal index space. Fix this by using the GIC SPI index from the parent domain's irq_data. Fixes: 783d31863fb82 ("irqchip: crossbar: Convert dra7 crossbar to stacked domains") Signed-off-by: Bhargav Joshi Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260620-irq-crossbar-fix-v2-1-b8e8499f468a@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/irqchip/irq-crossbar.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/drivers/irqchip/irq-crossbar.c +++ b/drivers/irqchip/irq-crossbar.c @@ -158,9 +158,14 @@ static void crossbar_domain_free(struct for (i = 0; i < nr_irqs; i++) { struct irq_data *d = irq_domain_get_irq_data(domain, virq + i); + /* + * irq_map[] is indexed by GIC SPI number. The parent domain's + * hwirq contains the GIC interrupt number (GIC SPI + + * GIC_IRQ_START). + */ + cb->irq_map[d->parent_data->hwirq - GIC_IRQ_START] = IRQ_FREE; + cb->write(d->parent_data->hwirq - GIC_IRQ_START, cb->safe_map); irq_domain_reset_irq_data(d); - cb->irq_map[d->hwirq] = IRQ_FREE; - cb->write(d->hwirq, cb->safe_map); } raw_spin_unlock(&cb->lock); irq_domain_free_irqs_parent(domain, virq, nr_irqs);