* [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup
2026-07-14 12:23 [PATCH 00/16] irqchip: harden initialization error paths Haofeng Li
@ 2026-07-14 12:23 ` Haofeng Li
2026-07-14 13:15 ` Anup Patel
2026-07-25 16:13 ` Radu Rendec
2026-07-14 13:24 ` [PATCH 03/16] irqchip/sifive-plic: do not iounmap devm mappings Haofeng Li
` (2 subsequent siblings)
3 siblings, 2 replies; 9+ messages in thread
From: Haofeng Li @ 2026-07-14 12:23 UTC (permalink / raw)
To: tglx
Cc: linux-kernel, Haofeng Li, Haofeng Li, Anup Patel, Paul Walmsley,
Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Björn Töpel,
linux-riscv
The MSI page lookup loop uses:
for (j = 0; nr_mmios; j++)
When nr_mmios is non-zero the condition is always true, so j is never
bounded. If reloff does not fall in any MMIO region the loop indexes
past mmios[] and may hang or fault.
Also, mmios_va starts as NULL. If its allocation fails, the out_iounmap
path indexes mmios_va[i] and NULL-dereferences.
Bound the loop with j < nr_mmios, and guard the iounmap/kfree cleanup
with if (mmios_va).
Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
---
drivers/irqchip/irq-riscv-imsic-state.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
index b8d1bbbf42f7..19f74cf79988 100644
--- a/drivers/irqchip/irq-riscv-imsic-state.c
+++ b/drivers/irqchip/irq-riscv-imsic-state.c
@@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
index = nr_mmios;
reloff = i * BIT(global->guest_index_bits) *
IMSIC_MMIO_PAGE_SZ;
- for (j = 0; nr_mmios; j++) {
+ for (j = 0; j < nr_mmios; j++) {
if (reloff < resource_size(&mmios[j])) {
index = j;
break;
@@ -953,11 +953,13 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
out_local_cleanup:
imsic_local_cleanup();
out_iounmap:
- for (i = 0; i < nr_mmios; i++) {
- if (mmios_va[i])
- iounmap(mmios_va[i]);
+ if (mmios_va) {
+ for (i = 0; i < nr_mmios; i++) {
+ if (mmios_va[i])
+ iounmap(mmios_va[i]);
+ }
+ kfree(mmios_va);
}
- kfree(mmios_va);
kfree(mmios);
out_free_local:
free_percpu(imsic->global.local);
--
2.25.1
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup
2026-07-14 12:23 ` [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup Haofeng Li
@ 2026-07-14 13:15 ` Anup Patel
2026-07-25 16:13 ` Radu Rendec
1 sibling, 0 replies; 9+ messages in thread
From: Anup Patel @ 2026-07-14 13:15 UTC (permalink / raw)
To: Haofeng Li
Cc: tglx, linux-kernel, Haofeng Li, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Björn Töpel, linux-riscv
On Tue, Jul 14, 2026 at 5:54 PM Haofeng Li <lihaofeng@kylinos.cn> wrote:
>
> The MSI page lookup loop uses:
>
> for (j = 0; nr_mmios; j++)
>
> When nr_mmios is non-zero the condition is always true, so j is never
> bounded. If reloff does not fall in any MMIO region the loop indexes
> past mmios[] and may hang or fault.
It is indeed an ugly typo in for-loop. I guess on most platforms
with AIA the below "if (reloff < resource_size(&mmios[j])) {" takes
care of loop termination but we can't rely on it.
>
> Also, mmios_va starts as NULL. If its allocation fails, the out_iounmap
> path indexes mmios_va[i] and NULL-dereferences.
>
> Bound the loop with j < nr_mmios, and guard the iounmap/kfree cleanup
> with if (mmios_va).
>
> Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
> Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
LGTM.
Reviewed-by: Anup Patel <anup@brainfault.org>
Thanks,
Anup
> ---
> drivers/irqchip/irq-riscv-imsic-state.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
> index b8d1bbbf42f7..19f74cf79988 100644
> --- a/drivers/irqchip/irq-riscv-imsic-state.c
> +++ b/drivers/irqchip/irq-riscv-imsic-state.c
> @@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
> index = nr_mmios;
> reloff = i * BIT(global->guest_index_bits) *
> IMSIC_MMIO_PAGE_SZ;
> - for (j = 0; nr_mmios; j++) {
> + for (j = 0; j < nr_mmios; j++) {
> if (reloff < resource_size(&mmios[j])) {
> index = j;
> break;
> @@ -953,11 +953,13 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
> out_local_cleanup:
> imsic_local_cleanup();
> out_iounmap:
> - for (i = 0; i < nr_mmios; i++) {
> - if (mmios_va[i])
> - iounmap(mmios_va[i]);
> + if (mmios_va) {
> + for (i = 0; i < nr_mmios; i++) {
> + if (mmios_va[i])
> + iounmap(mmios_va[i]);
> + }
> + kfree(mmios_va);
> }
> - kfree(mmios_va);
> kfree(mmios);
> out_free_local:
> free_percpu(imsic->global.local);
> --
> 2.25.1
>
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup
2026-07-14 12:23 ` [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup Haofeng Li
2026-07-14 13:15 ` Anup Patel
@ 2026-07-25 16:13 ` Radu Rendec
1 sibling, 0 replies; 9+ messages in thread
From: Radu Rendec @ 2026-07-25 16:13 UTC (permalink / raw)
To: Haofeng Li, tglx
Cc: linux-kernel, Haofeng Li, Anup Patel, Paul Walmsley,
Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Björn Töpel,
linux-riscv
On Tue, 2026-07-14 at 20:23 +0800, Haofeng Li wrote:
> The MSI page lookup loop uses:
>
> for (j = 0; nr_mmios; j++)
>
> When nr_mmios is non-zero the condition is always true, so j is never
> bounded. If reloff does not fall in any MMIO region the loop indexes
> past mmios[] and may hang or fault.
>
> Also, mmios_va starts as NULL. If its allocation fails, the out_iounmap
> path indexes mmios_va[i] and NULL-dereferences.
>
> Bound the loop with j < nr_mmios, and guard the iounmap/kfree cleanup
> with if (mmios_va).
>
> Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
> Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
> ---
> drivers/irqchip/irq-riscv-imsic-state.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
> index b8d1bbbf42f7..19f74cf79988 100644
> --- a/drivers/irqchip/irq-riscv-imsic-state.c
> +++ b/drivers/irqchip/irq-riscv-imsic-state.c
> @@ -896,7 +896,7 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
> index = nr_mmios;
> reloff = i * BIT(global->guest_index_bits) *
> IMSIC_MMIO_PAGE_SZ;
> - for (j = 0; nr_mmios; j++) {
> + for (j = 0; j < nr_mmios; j++) {
> if (reloff < resource_size(&mmios[j])) {
> index = j;
> break;
> @@ -953,11 +953,13 @@ int __init imsic_setup_state(struct fwnode_handle *fwnode, void *opaque)
> out_local_cleanup:
> imsic_local_cleanup();
> out_iounmap:
> - for (i = 0; i < nr_mmios; i++) {
> - if (mmios_va[i])
> - iounmap(mmios_va[i]);
> + if (mmios_va) {
> + for (i = 0; i < nr_mmios; i++) {
> + if (mmios_va[i])
> + iounmap(mmios_va[i]);
> + }
> + kfree(mmios_va);
> }
> - kfree(mmios_va);
> kfree(mmios);
> out_free_local:
> free_percpu(imsic->global.local);
Reviewed-by: Radu Rendec <radu@rendec.net>
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 03/16] irqchip/sifive-plic: do not iounmap devm mappings
2026-07-14 12:23 [PATCH 00/16] irqchip: harden initialization error paths Haofeng Li
2026-07-14 12:23 ` [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup Haofeng Li
@ 2026-07-14 13:24 ` Haofeng Li
2026-07-14 15:05 ` Anup Patel
2026-08-20 6:36 ` Thomas Gleixner
2026-07-25 16:29 ` [PATCH 00/16] irqchip: harden initialization error paths Radu Rendec
2026-08-20 7:49 ` Thomas Gleixner
3 siblings, 2 replies; 9+ messages in thread
From: Haofeng Li @ 2026-07-14 13:24 UTC (permalink / raw)
To: tglx
Cc: Haofeng Li, Haibo Xu, Anup Patel, Rafael J. Wysocki, linux-kernel,
Samuel Holland, Paul Walmsley, Haofeng Li, linux-riscv
From: Haofeng Li <lihaofeng@kylinos.cn>
plic_probe() maps registers with of_iomap() on the OF path, but with
devm_platform_ioremap_resource() on the ACPI/platform path.
fail_free_regs always calls iounmap(regs), which double-unmaps managed
mappings on the non-OF path.
Only call iounmap(regs) when the fwnode is an OF node.
Fixes: 206dd13a1011 ("irqchip/sifive-plic: Add ACPI support")
Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
---
drivers/irqchip/irq-sifive-plic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
index 5b0dac104814..0bddad388741 100644
--- a/drivers/irqchip/irq-sifive-plic.c
+++ b/drivers/irqchip/irq-sifive-plic.c
@@ -819,7 +819,9 @@ static int plic_probe(struct fwnode_handle *fwnode)
fail_free_priv:
kfree(priv);
fail_free_regs:
- iounmap(regs);
+ /* Only OF path uses of_iomap(); ACPI/platform uses devm mapping. */
+ if (is_of_node(fwnode))
+ iounmap(regs);
return error;
}
--
2.25.1
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH 03/16] irqchip/sifive-plic: do not iounmap devm mappings
2026-07-14 13:24 ` [PATCH 03/16] irqchip/sifive-plic: do not iounmap devm mappings Haofeng Li
@ 2026-07-14 15:05 ` Anup Patel
2026-08-20 6:36 ` Thomas Gleixner
1 sibling, 0 replies; 9+ messages in thread
From: Anup Patel @ 2026-07-14 15:05 UTC (permalink / raw)
To: Haofeng Li
Cc: Samuel Holland, Haibo Xu, Rafael J. Wysocki, linux-kernel,
Haofeng Li, tglx, Paul Walmsley, Haofeng Li, linux-riscv
On Tue, Jul 14, 2026 at 6:56 PM Haofeng Li <920484857@qq.com> wrote:
>
> From: Haofeng Li <lihaofeng@kylinos.cn>
>
> plic_probe() maps registers with of_iomap() on the OF path, but with
> devm_platform_ioremap_resource() on the ACPI/platform path.
> fail_free_regs always calls iounmap(regs), which double-unmaps managed
> mappings on the non-OF path.
devm_platform_ioremap_resource() can't be used for OF because
we have one outlier platform "allwinner,sun20i-d1-plic" which still
relies on early irqchip probe using IRQCHIP_DECLARE() and
the platform device is not available in early irqchip probe.
>
> Only call iounmap(regs) when the fwnode is an OF node.
>
> Fixes: 206dd13a1011 ("irqchip/sifive-plic: Add ACPI support")
> Signed-off-by: Haofeng Li <lihaofeng@kylinos.cn>
LGTM.
Reviewed-by: Anup Patel <anup@brainfault.org>
Thanks,
Anup
> --
> drivers/irqchip/irq-sifive-plic.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
> index 5b0dac104814..0bddad388741 100644
> --- a/drivers/irqchip/irq-sifive-plic.c
> +++ b/drivers/irqchip/irq-sifive-plic.c
> @@ -819,7 +819,9 @@ static int plic_probe(struct fwnode_handle *fwnode)
> fail_free_priv:
> kfree(priv);
> fail_free_regs:
> - iounmap(regs);
> + /* Only OF path uses of_iomap(); ACPI/platform uses devm mapping. */
> + if (is_of_node(fwnode))
> + iounmap(regs);
> return error;
> }
>
> --
> 2.25.1
>
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH 03/16] irqchip/sifive-plic: do not iounmap devm mappings
2026-07-14 13:24 ` [PATCH 03/16] irqchip/sifive-plic: do not iounmap devm mappings Haofeng Li
2026-07-14 15:05 ` Anup Patel
@ 2026-08-20 6:36 ` Thomas Gleixner
1 sibling, 0 replies; 9+ messages in thread
From: Thomas Gleixner @ 2026-08-20 6:36 UTC (permalink / raw)
To: Haofeng Li
Cc: Haofeng Li, Haibo Xu, Anup Patel, Rafael J. Wysocki, linux-kernel,
Samuel Holland, Paul Walmsley, Haofeng Li, linux-riscv
On Tue, Jul 14 2026 at 21:24, Haofeng Li wrote:
> - iounmap(regs);
> + /* Only OF path uses of_iomap(); ACPI/platform uses devm mapping. */
Instead of this comment and conditional unmap the OF specific map side
should just use devm_of_iomap(), no?
> + if (is_of_node(fwnode))
> + iounmap(regs);
> return error;
> }
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 00/16] irqchip: harden initialization error paths
2026-07-14 12:23 [PATCH 00/16] irqchip: harden initialization error paths Haofeng Li
2026-07-14 12:23 ` [PATCH 01/16] irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup Haofeng Li
2026-07-14 13:24 ` [PATCH 03/16] irqchip/sifive-plic: do not iounmap devm mappings Haofeng Li
@ 2026-07-25 16:29 ` Radu Rendec
2026-08-20 7:49 ` Thomas Gleixner
3 siblings, 0 replies; 9+ messages in thread
From: Radu Rendec @ 2026-07-25 16:29 UTC (permalink / raw)
To: Haofeng Li
Cc: tglx, linux-kernel, Haofeng Li, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Samuel Holland, linux-riscv
On Tue, 2026-07-14 at 20:23 +0800, Haofeng Li wrote:
> An audit of irqchip initialization and allocation error paths found a
> collection of resource leaks and lifetime issues across several drivers.
>
> The most serious cases leave interrupt handlers or other globally visible
> state pointing at memory that is subsequently freed or unmapped. Other
> cases leak IRQ domains, parent mappings, MMIO mappings, allocation bitmap
> regions, or allocated objects when initialization fails part-way through.
> The series also fixes an unbounded IMSIC MMIO lookup, a possible NULL MMIO
> access in the NVIDIA T241 workaround, and two cases where useful error
> information is lost or reported incorrectly.
>
> The changes are confined to failure handling; successful initialization
> paths are left unchanged. The MIPS GIC fixes in patches 7 and 8 build on
> each other, as do the Realtek RTL fixes in patches 12 and 13. The remaining
> patches are independent.
>
> The issues addressed are:
>
> - bound MMIO lookup and make allocation cleanup NULL-safe;
> - roll back partially allocated IRQs, domains and bitmap regions;
> - do not free or unmap state after it has been published to live users;
> - distinguish managed from unmanaged MMIO mappings during cleanup;
> - release parent IRQ mappings, per-CPU mappings and OF node references;
> - preserve deferred-probe errors and report the correct reset error.
>
> Haofeng Li (16):
> irqchip/riscv-imsic: fix MMIO lookup OOB and NULL cleanup
> irqchip/loongarch-ir: fix redirect free and alloc leaks
> irqchip/sifive-plic: do not iounmap devm mappings
> irqchip/crossbar: fix allocation and init cleanup
> irqchip/bcm7038-l1: clean up init failure paths
> irqchip/loongson-liointc: unmap per-core iomaps on error
> irqchip/mips-gic: clean up IRQ domain creation failure
> irqchip/mips-gic: clean up if IPI domain registration fails
> irqchip/econet: clean up VEIC initialization
> irqchip/aspeed-vic: publish handler only after domain creation
> irqchip/loongson-eiointc: preserve live state on cascade failure
> irqchip/realtek-rtl: unmap per-CPU bases on init failure
> irqchip/realtek-rtl: dispose parent mapping on domain failure
> irqchip/renesas-rzg2l: fix wrong errno in reset error log
> irqchip/gic-v3: fail T241 quirk if alias ioremap fails
> irqchip/bcm7120-l2: fix parent IRQ count error handling
Patches 3-16 in your series use a different email address than this
cover letter and patches 1-2. This is not a showstopper but makes it
harder to process your series using tools like b4.
Please use a consistent email address in the future, particularly if
you post another version of this series for any reason. Thanks!
> drivers/irqchip/irq-aspeed-vic.c | 23 ++++++++++++++----
> drivers/irqchip/irq-bcm7038-l1.c | 24 +++++++++++++++----
> drivers/irqchip/irq-bcm7120-l2.c | 8 +++++--
> drivers/irqchip/irq-crossbar.c | 23 ++++++++++++++++--
> drivers/irqchip/irq-econet-en751221.c | 5 +++-
> drivers/irqchip/irq-gic-v3.c | 11 ++++++++-
> drivers/irqchip/irq-loongarch-ir.c | 21 +++++++++++++++--
> drivers/irqchip/irq-loongson-eiointc.c | 13 ++++++-----
> drivers/irqchip/irq-loongson-liointc.c | 8 +++++++
> drivers/irqchip/irq-mips-gic.c | 31 +++++++++++++++----------
> drivers/irqchip/irq-realtek-rtl.c | 28 ++++++++++++++++++----
> drivers/irqchip/irq-renesas-rzg2l.c | 2 +-
> drivers/irqchip/irq-riscv-imsic-state.c | 12 ++++++----
> drivers/irqchip/irq-sifive-plic.c | 4 +++-
> 14 files changed, 168 insertions(+), 45 deletions(-)
>
>
> base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 00/16] irqchip: harden initialization error paths
2026-07-14 12:23 [PATCH 00/16] irqchip: harden initialization error paths Haofeng Li
` (2 preceding siblings ...)
2026-07-25 16:29 ` [PATCH 00/16] irqchip: harden initialization error paths Radu Rendec
@ 2026-08-20 7:49 ` Thomas Gleixner
3 siblings, 0 replies; 9+ messages in thread
From: Thomas Gleixner @ 2026-08-20 7:49 UTC (permalink / raw)
To: Haofeng Li
Cc: linux-kernel, Haofeng Li, Haofeng Li, Paul Walmsley,
Palmer Dabbelt, Albert Ou, Alexandre Ghiti, Samuel Holland,
linux-riscv, Marc Zyngier, Radu Rendec
On Tue, Jul 14 2026 at 20:23, Haofeng Li wrote:
> An audit of irqchip initialization and allocation error paths found a
> collection of resource leaks and lifetime issues across several drivers.
A lot of these "fixes" are purely cosmetic and create a false sense of
correctness because if the initialization of the root interrupt
controller of a system fails then machine won't boot at all.
So instead of adding tons of cleanups we rather go and analyze which
controllers are actually root controllers and therefore essential for
the machine to boot. For those the only valid error handling is:
__probe(....)
{
all setup magic
}
probe(....)
{
if (__probe(..._))
panic("Failed to initialize root interrupt controller");
}
That is the proper hardening and allows to remove a boatload of
pointless cleanups.
Where cleanups actually matter are for secondary interrupt controllers
which are not essential for the machine to get up and "running",
especially those which can be built as modules.
Thanks,
tglx
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 9+ messages in thread