diff options
| author | Pengpeng Hou <hppiscas@163.com> | 2026-09-20 21:07:54 +0800 |
|---|---|---|
| committer | Thomas Gleixner <tglx@kernel.org> | 2026-10-15 11:50:48 +0200 |
| commit | 8caa8fcec8db5358437b9b7ca456bc3093d2a4d0 (patch) | |
| tree | e412f0259b1956e293983507bfae281fc568babc /drivers/irqchip | |
| parent | 0f214e5bbee59d5952d3c061fd65ed9a1e175981 (diff) | |
irqchip/riscv-imsic: Reject overlapping group index fields
The IMSIC address layout places the group index above the page offset,
guest index and HART index. imsic_parse_fwnode() checks the individual
field widths and the upper end of the group field, but does not check
that its lower end is above the other fields.
Reject a nonzero group field whose shift overlaps the lower fields.
Otherwise a firmware-supplied layout can assign the same address bit to
different indices when MSI target addresses are constructed.
Keep the existing upper-bound check unchanged. The new lower-bound
check applies only when group index bits are present.
The issue was found by our static-analysis tool.
Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
Signed-off-by: Pengpeng Hou <hppiscas@163.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: gpt 5
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://patch.msgid.link/caplitmus-rv.v2.imsic.f2c0e5bdc627451c83deb0cf7eb8834a@163.com
Diffstat (limited to 'drivers/irqchip')
| -rw-r--r-- | drivers/irqchip/irq-riscv-imsic-state.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c index 9505ddbd9eec..960c71d6295b 100644 --- a/drivers/irqchip/irq-riscv-imsic-state.c +++ b/drivers/irqchip/irq-riscv-imsic-state.c @@ -740,6 +740,14 @@ static int __init imsic_parse_fwnode(struct fwnode_handle *fwnode, return -EINVAL; } + /* Group index bits must not overlap guest and HART index bits. */ + i = IMSIC_MMIO_PAGE_SHIFT + global->guest_index_bits + + global->hart_index_bits; + if (global->group_index_bits && global->group_index_shift < i) { + pr_err("%pfwP: group index shift too small\n", fwnode); + return -EINVAL; + } + /* Sanity check group index shift */ i = global->group_index_bits + global->group_index_shift - 1; if (i >= BITS_PER_LONG) { |