[PATCH] irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()

[PATCH] irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()

[Dan Carpenter]

If the irq_domain_translate_twocell() function sets "hwirq" to >=
MCHP_EIC_NIRQ (2) then it would result in an out of bounds access.
The code here checks for invalid values, but doesn't set the error
code.  Return -EINVAL in that case, instead of returning success.

Fixes: 00fa3461c86d ("irqchip/mchp-eic: Add support for the Microchip EIC")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 drivers/irqchip/irq-mchp-eic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-mchp-eic.c b/drivers/irqchip/irq-mchp-eic.c
index 2474fa467a05..31093a8ab67c 100644
--- a/drivers/irqchip/irq-mchp-eic.c
+++ b/drivers/irqchip/irq-mchp-eic.c
@@ -170,7 +170,7 @@ static int mchp_eic_domain_alloc(struct irq_domain *domain, unsigned int virq,
 
 	ret = irq_domain_translate_twocell(domain, fwspec, &hwirq, &type);
 	if (ret || hwirq >= MCHP_EIC_NIRQ)
-		return ret;
+		return ret ?: -EINVAL;
 
 	switch (type) {
 	case IRQ_TYPE_EDGE_RISING:
-- 
2.51.0

Re: [PATCH] irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()

[Claudiu Beznea]

On 12/9/25 08:54, Dan Carpenter wrote:
> If the irq_domain_translate_twocell() function sets "hwirq" to >=
> MCHP_EIC_NIRQ (2) then it would result in an out of bounds access.
> The code here checks for invalid values, but doesn't set the error
> code.  Return -EINVAL in that case, instead of returning success.
> 
> Fixes: 00fa3461c86d ("irqchip/mchp-eic: Add support for the Microchip EIC")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>

Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>

[tip: irq/urgent] irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()

[tip-bot2 for Dan Carpenter]

The following commit has been merged into the irq/urgent branch of tip:

Commit-ID:     7dbc0d40d8347bd9de55c904f59ea44bcc8dedb7
Gitweb:        https://git.kernel.org/tip/7dbc0d40d8347bd9de55c904f59ea44bcc8dedb7
Author:        Dan Carpenter <dan.carpenter@linaro.org>
AuthorDate:    Tue, 09 Dec 2025 09:54:16 +03:00
Committer:     Thomas Gleixner <tglx@linutronix.de>
CommitterDate: Wed, 10 Dec 2025 12:11:06 +09:00

irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()

If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then
it results in an out of bounds access.

The code checks for invalid values, but doesn't set the error code.  Return
-EINVAL in that case, instead of returning success.

Fixes: 00fa3461c86d ("irqchip/mchp-eic: Add support for the Microchip EIC")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Link: https://patch.msgid.link/aTfHmOz6IBpTIPU5@stanley.mountain
---
 drivers/irqchip/irq-mchp-eic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-mchp-eic.c b/drivers/irqchip/irq-mchp-eic.c
index 2474fa4..31093a8 100644
--- a/drivers/irqchip/irq-mchp-eic.c
+++ b/drivers/irqchip/irq-mchp-eic.c
@@ -170,7 +170,7 @@ static int mchp_eic_domain_alloc(struct irq_domain *domain, unsigned int virq,
 
 	ret = irq_domain_translate_twocell(domain, fwspec, &hwirq, &type);
 	if (ret || hwirq >= MCHP_EIC_NIRQ)
-		return ret;
+		return ret ?: -EINVAL;
 
 	switch (type) {
 	case IRQ_TYPE_EDGE_RISING: