[tip: irq/drivers] irqchip/mst-intc: Validate the DT interrupt range

[tip-bot2 for Pengpeng Hou]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     16f25d326e5d3b9fd51bc5e3916ecbffbca63e7b
Gitweb:        https://git.kernel.org/tip/16f25d326e5d3b9fd51bc5e3916ecbffbca63e7b
Author:        Pengpeng Hou <hppiscas@xxxxxxx>
AuthorDate:    Sun, 20 Sep 2026 11:42:36 +08:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Thu, 15 Oct 2026 11:50:47 +02:00

irqchip/mst-intc: Validate the DT interrupt range

The driver takes an inclusive interrupt range from the device tree
without checking its endpoints. A reversed range wraps the unsigned
count calculation, and a range larger than MST_INTC_MAX_IRQS exceeds the
controller capacity used by the driver.

Reject these ranges before calculating nr_irqs or creating the domain.
Check the difference after ordering the endpoints so the validation
itself cannot wrap.

The issue was found by our static-analysis tool.

Fixes: ad4c938c92af ("irqchip/irq-mst: Add MStar interrupt controller support")
Signed-off-by: Pengpeng Hou <hppiscas@xxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Assisted-by: gpt 5
Reviewed-by: Radu Rendec <radu@xxxxxxxxxx>
Link: https://patch.msgid.link/20260920034236.16229-1-hppiscas@xxxxxxx
---
 drivers/irqchip/irq-mst-intc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c
index b5335f6..1070de5 100644
--- a/drivers/irqchip/irq-mst-intc.c
+++ b/drivers/irqchip/irq-mst-intc.c
@@ -263,6 +263,9 @@ static int __init mst_intc_of_init(struct device_node *dn,
 	    of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end))
 		return -EINVAL;
 
+	if (irq_end < irq_start || irq_end - irq_start >= MST_INTC_MAX_IRQS)
+		return -EINVAL;
+
 	cd = kzalloc_obj(*cd);
 	if (!cd)
 		return -ENOMEM;