From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E47CC3E0C57 for ; Wed, 5 Aug 2026 19:27:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785958073; cv=none; b=K5O+JamKPMwGVjY/sL+PjGFSP0mhvhnmSJjGt+8vtHtcLAtOPqfrwI/FKCp0eO/D8/Ldwh2sFy1VTP2O2AHkICOCN1lTWTPZHIbBvCC4g3ki/S+bXT1za6Pld1qiA/D3eOS2BCe5IPSGSz5cQz6JFT0AqnapgDgVQX8cwH9g5lg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785958073; c=relaxed/simple; bh=dVeNTpPB9YZx9hYK/eMTS366qVwI6Kw1emblFf6LxQo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YeS7BPb8Ju9n1mAyyMvIO1sNOlqg0o9pRNYE2UZyL7xrgYXdIE/VdZ3j5wGVw6xmKuGYDkLADP65OVXQ2rgl8Cm0YVe+0atU+CLfKlqFTlIFz9qiYyAPI3yAyI837SYTLz8G0PO4/U7ov70ZghgrDArk3GyXTs30Gpm1RniRlGo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UwHRxqpu; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UwHRxqpu" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38e3617ba36so1455758a91.3 for ; Wed, 05 Aug 2026 12:27:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785958071; x=1786562871; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Z397hzjtlhoJsdjyJYMPtMJAiE67KesRcDumfIuyFeI=; b=UwHRxqpub8bDCxsMHp2B4z3+M1GdBqSHocdqTa0YrU2exCNv6KZzHB4DgsO28uo7RM BbMdKOgzBihCGQX3RF5LGlPgr1eYyuGNz3PED8JGhEGW1xBwIoYR/uWT6k96neAOs44J QTH2zjbP2Rvh1E5G111bbVwvxJYS6em1S4ai4tjLmmLRADcLwQ3cl4g8x5HjrCYMqOl6 ClcjqZyglPYV6Tox/B1ooZiWI+b/YGQL653lz16eVvFHzimcT598wlrxkUaeNmmKO7Yn K4Ix6y/dLNml4A973TMy5w4SQtzs4MfVtmjVLlGHDFR7lX03kfyhsPuCLKkHgKYZb1rO Ulkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785958071; x=1786562871; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Z397hzjtlhoJsdjyJYMPtMJAiE67KesRcDumfIuyFeI=; b=P8Xu8gWcQefPM412bWlhYiR4e6zCcH9kwSgfTJtZiPNSxi+WtmHjs7xjWkIKEmkT5h dSyMOhsYwSR2NvZCNYkKqH3iq1fW30EVCqYpDN/d1vsLKvSYSAlq18hSIrEK+FmuTQlE MMkp4zjUz92og5aE4h4V+EVmSrv6ccnZcj3YMS8Ey+JafJyW7c4S7uekttS7ygwZpuQg M+ieyGl4eO3rLaPN7wpT9uLAPZjpdssifnU0HkG4o7YzMjUdHO6aOnlJDvONg60/9SZc N3+z3x1rhIdvS94xpriNKbEO8wWzoYaEVImF+rrWQMsp51znXqNLZdf2sxHtQRNYN1q0 dpdg== X-Forwarded-Encrypted: i=1; AHgh+Rr+oB0DfymoVugSSwTPF97IhM2//Xpo9Yd6gxUw2gYetpcQdF9+64+IAuuc3FG+h4qXaM02zOf+jFDFnvs=@vger.kernel.org X-Gm-Message-State: AOJu0YwJWrhPUldn4twsvI1oeEgMktyR6seqJmyNM/dl3n6QURNggEtr DEpJfVh1w/eBafvMbiS100Xms5Fe+TtmM46hzDScrU0n5uA9vFYtxDMmwkPeSw== X-Gm-Gg: AR+sD12p6Bf1cYBhBEhTZNNtYcrwo7Rg8809tJzGoQrtVIeilb22YQf1lEnljV7kipt E1JWXsQ8JKVMM2NBuXhU1Z/Cwf+wgl/MK1Kto2M0YVSVZuNXIDpc0PQGTFZkouyxlDHmR3kWD6X ok2PGZt79XXIFFoBulicSNyrolECDXn+QwSgAGGutUvcJJxDScVnK33AdMdYBhHL4XEMuKrAvs9 RagfYHHbRc9ExYtETDXMOVKO6YDeuSHGjXdxuVWyAcAl8zkdUY6VsnXPBfTXawNI6leYh157AQK 5aBuLCz1I2k9xXBiWnqdf2YKcoTkQvn5OJFqrSEYZbjnzYRpjiHEA+NFDzIFdKQGQhWYOEBKt4L GogGbpO4sEWgoDnEkYAGkCpLKO+EE3whWKd35N4RnYC1aEOrz7RRIyrGrUFPV6uNzJZs+pzQSS/ QiMRPhr4/qyRjroooC1WGUXDaXXpzdtG+QBoKFeWf3BosfWtUPTXdyyFwCGsv3Fi9KYGor5O/Vi pxZ8nimXKD+/qGFFaKkX+x40D5bhJ6+nCiwgQ== X-Received: by 2002:a17:90b:5203:b0:37d:f206:a2ac with SMTP id 98e67ed59e1d1-3903c598ce5mr10207058a91.7.1785958071130; Wed, 05 Aug 2026 12:27:51 -0700 (PDT) Received: from fabio-X870-EAGLE-WIFI7.. ([2804:1b3:a801:e1cd:bc4c:d677:df1f:9a88]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13fca63ce12sm20260391c88.5.2026.08.05.12.27.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Aug 2026 12:27:50 -0700 (PDT) From: Fabio Estevam To: tglx@kernel.org Cc: radu@rendec.net, Frank.Li@nxp.com, imx@lists.linux.dev, linux-kernel@vger.kernel.org, Fabio Estevam Subject: [PATCH v3 2/2] irqchip/imx-irqsteer: Validate IRQ count before creating domain Date: Wed, 5 Aug 2026 16:27:43 -0300 Message-ID: <20260805192743.244441-2-festevam@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260805192743.244441-1-festevam@gmail.com> References: <20260805192743.244441-1-festevam@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Fabio Estevam The IRQ count is validated after creating the IRQ domain. If it is invalid, probe returns without removing the domain, leaving its host data pointing at devm-managed memory that is freed on probe failure. Validate the count before allocating resources to avoid the leak and dangling pointer. Fixes: 28528fca4908 ("irqchip/imx-irqsteer: Add multi output interrupts support") Signed-off-by: Fabio Estevam --- Changes since v2: - Newly introduced. drivers/irqchip/irq-imx-irqsteer.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/irqchip/irq-imx-irqsteer.c b/drivers/irqchip/irq-imx-irqsteer.c index 653e25115083..55aec60dee40 100644 --- a/drivers/irqchip/irq-imx-irqsteer.c +++ b/drivers/irqchip/irq-imx-irqsteer.c @@ -217,6 +217,8 @@ static int imx_irqsteer_probe(struct platform_device *pdev) */ data->irq_count = DIV_ROUND_UP(irqs_num, 64); data->reg_num = irqs_num / 32; + if (!data->irq_count || data->irq_count > CHAN_MAX_OUTPUT_INT) + return -EINVAL; if (IS_ENABLED(CONFIG_PM)) { data->saved_reg = devm_kzalloc(&pdev->dev, @@ -250,11 +252,6 @@ static int imx_irqsteer_probe(struct platform_device *pdev) } irq_domain_set_pm_device(data->domain, &pdev->dev); - if (!data->irq_count || data->irq_count > CHAN_MAX_OUTPUT_INT) { - ret = -EINVAL; - goto out; - } - for (i = 0; i < data->irq_count; i++) { data->irq[i] = irq_of_parse_and_map(np, i); if (!data->irq[i]) -- 2.43.0