Re: [PATCH v3 3/5] powerpc/xive: propagate IPI init errors to prevent use-after-free

["Cédric Le Goater" <clg@kaod.org>]

On 7/27/26 12:42, Gou Hao wrote:
> When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),
> the error path frees the global xive_ipis array.  However,
> xive_smp_probe() previously ignored this failure and proceeded to
> call xive_setup_cpu_ipi(), which dereferences the already-freed
> xive_ipis pointer -- a use-after-free.
> 
> Now that xive_smp_probe() returns int (previous patch), propagate
> the error from xive_init_ipis() and xive_setup_cpu_ipi() through
> xive_smp_probe().  Check the return value in both pnv_smp_probe()
> and pSeries_smp_probe() so that IPI setup is aborted cleanly on
> failure, avoiding the use-after-free.
> 
> Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller")
> Fixes: cbc06f051c52 ("powerpc/xive: Do not skip CPU-less nodes when creating the IPIs")
> Signed-off-by: Gou Hao <gouhao@uniontech.com>
> Reviewed-by: Wentao Guan <guanwentao@uniontech.com>
> Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com>
> ---
>   arch/powerpc/platforms/powernv/smp.c |  8 +++++---
>   arch/powerpc/platforms/pseries/smp.c |  8 +++++---
>   arch/powerpc/sysdev/xive/common.c    | 10 ++++++----
>   3 files changed, 16 insertions(+), 10 deletions(-)
> 
> diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
> index 8f41ef364fc6..b1201dbafcaf 100644
> --- a/arch/powerpc/platforms/powernv/smp.c
> +++ b/arch/powerpc/platforms/powernv/smp.c
> @@ -332,10 +332,12 @@ static void pnv_cause_ipi(int cpu)
>   
>   static void __init pnv_smp_probe(void)
>   {
> -	if (xive_enabled())
> -		xive_smp_probe();
> -	else
> +	if (xive_enabled()) {
> +		if (xive_smp_probe() < 0)
> +			return;
> +	} else {
>   		xics_smp_probe();
> +	}
>   
>   	if (cpu_has_feature(CPU_FTR_DBELL)) {
>   		ic_cause_ipi = smp_ops->cause_ipi;
> diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
> index db99725e752b..14cd0634eeca 100644
> --- a/arch/powerpc/platforms/pseries/smp.c
> +++ b/arch/powerpc/platforms/pseries/smp.c
> @@ -194,10 +194,12 @@ static int pseries_cause_nmi_ipi(int cpu)
>   
>   static __init void pSeries_smp_probe(void)
>   {
> -	if (xive_enabled())
> -		xive_smp_probe();
> -	else
> +	if (xive_enabled()) {
> +		if (xive_smp_probe() < 0)
> +			return;
> +	} else {
>   		xics_smp_probe();
> +	}
>   
>   	/* No doorbell facility, must use the interrupt controller for IPIs */
>   	if (!cpu_has_feature(CPU_FTR_DBELL))
> diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
> index 9f80c16be23f..bbe7c85274ea 100644
> --- a/arch/powerpc/sysdev/xive/common.c
> +++ b/arch/powerpc/sysdev/xive/common.c
> @@ -1267,15 +1267,17 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc)
>   
>   int __init xive_smp_probe(void)
>   {
> +	int ret;
> +
>   	smp_ops->cause_ipi = xive_cause_ipi;
>   
>   	/* Register the IPI */
> -	xive_init_ipis();
> +	ret = xive_init_ipis();
> +	if (ret < 0)
> +		return ret;
>   
>   	/* Allocate and setup IPI for the boot CPU */
> -	xive_setup_cpu_ipi(smp_processor_id());
> -
> -	return 0;
> +	return xive_setup_cpu_ipi(smp_processor_id());
>   }
>   
>   #endif /* CONFIG_SMP */

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Thanks,

C.