diff options
| author | Nam Cao <namcao@linutronix.de> | 2025-08-04 12:07:27 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-19 16:30:51 +0200 |
| commit | 9f88a6fd974857b84833c8eea95e5c17897ebd25 (patch) | |
| tree | 947f6318e0e6799e93f8d328b99f51098e09d782 /arch | |
| parent | 83319fa81e60fe53fd11625d54b3d5446e4e9efc (diff) | |
| download | linux-9f88a6fd974857b84833c8eea95e5c17897ebd25.tar.gz linux-9f88a6fd974857b84833c8eea95e5c17897ebd25.tar.bz2 linux-9f88a6fd974857b84833c8eea95e5c17897ebd25.zip | |
powerpc/pseries/msi: Fix potential underflow and leak issue
commit 3443ff3be6e59b80d74036bb39f5b6409eb23cc9 upstream.
pseries_irq_domain_alloc() allocates interrupts at parent's interrupt
domain. If it fails in the progress, all allocated interrupts are
freed.
The number of successfully allocated interrupts so far is stored
"i". However, "i - 1" interrupts are freed. This is broken:
- One interrupt is not be freed
- If "i" is zero, "i - 1" wraps around
Correct the number of freed interrupts to 'i'.
Fixes: a5f3d2c17b07 ("powerpc/pseries/pci: Add MSI domains")
Signed-off-by: Nam Cao <namcao@linutronix.de>
Cc: stable@vger.kernel.org
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/a980067f2b256bf716b4cd713bc1095966eed8cd.1754300646.git.namcao@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/powerpc/platforms/pseries/msi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c index fdcf10cd4d12..b53f817fc421 100644 --- a/arch/powerpc/platforms/pseries/msi.c +++ b/arch/powerpc/platforms/pseries/msi.c @@ -587,7 +587,7 @@ static int pseries_irq_domain_alloc(struct irq_domain *domain, unsigned int virq out: /* TODO: handle RTAS cleanup in ->msi_finish() ? */ - irq_domain_free_irqs_parent(domain, virq, i - 1); + irq_domain_free_irqs_parent(domain, virq, i); return ret; } |