Re: [PATCH] sh: intc: sort the prio and sense lists after filling them

[John Paul Adrian Glaubitz]

Hi Geert,

On Wed, 2026-10-14 at 09:03 +0200, Geert Uytterhoeven wrote:
> Hi Karl,
> 
> On Sun, 27 Sept 2026 at 21:14, Karl Mehltretter <kmehltretter@xxxxxxxxx> wrote:
> > register_intc_controller() sorts d->prio and d->sense right after
> > allocating them, with hw->nr_prio_regs and hw->nr_sense_regs as the
> > element count. The lists hold hw->nr_vectors entries and are only
> > filled later, by intc_register_irq().
> > 
> > On SH7785, sh7785-irq0123 and sh7785-irq4567 have four vectors but the
> > SoC's eleven priority registers, so sort() swaps 88 bytes in a 32 byte
> > kmalloc object at boot. slub_debug=FZPU reports "Right Redzone
> > overwritten" in kmalloc-32, and v6.5 and v6.6 panic in
> > __kmem_cache_alloc_node() while registering sh7785-irq0123.
> > 
> > Found with a custom QEMU model of the SH7785LCR. On it, v6.4
> > sh7785lcr_defconfig boots with SLAB, the defconfig default before v6.5,
> > and hangs before the console is up when built with SLUB.
> > 
> > Sort the lists once all vectors are registered, with the number of
> > entries that were added.
> > 
> > Fixes: b59f9f9775e6 ("sh: intc: optimize intc IRQ lookup")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: LLM
> > Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
> 
> Thanks for your patch!
> 
> > --- a/drivers/sh/intc/core.c
> > +++ b/drivers/sh/intc/core.c
> > @@ -275,9 +275,6 @@ int __init register_intc_controller(struct intc_desc *desc)
> >                         k += save_reg(d, k, hw->prio_regs[i].set_reg, smp);
> >                         k += save_reg(d, k, hw->prio_regs[i].clr_reg, smp);
> >                 }
> > -
> > -               sort(d->prio, hw->nr_prio_regs, sizeof(*d->prio),
> > -                    intc_handle_int_cmp, NULL);
> 
> Yeah, if hw->nr_prio_regs > hw->nr_vectors, this overflows d->prio[].
> Furthermore, this sorting is useless, as d->prio[] is still empty
> (all zeroes).
> 
> >         }
> > 
> >         if (hw->sense_regs) {
> > @@ -287,9 +284,6 @@ int __init register_intc_controller(struct intc_desc *desc)
> > 
> >                 for (i = 0; i < hw->nr_sense_regs; i++)
> >                         k += save_reg(d, k, hw->sense_regs[i].reg, 0);
> > -
> > -               sort(d->sense, hw->nr_sense_regs, sizeof(*d->sense),
> > -                    intc_handle_int_cmp, NULL);
> 
> Similar.
> 
> >         }
> > 
> >         if (hw->subgroups)
> 
> Reviewed-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>

Thanks for the additional review. I have already merged this patch in my
tree, but I will add your Reviewed-by with some git foo.

Adrian

-- 
 .''`.  John Paul Adrian Glaubitz
: :' :  Debian Developer
`. `'   Physicist
  `-    GPG: 62FF 8A75 84E0 2956 9546  0006 7426 3B37 F5B5 F913