Re: [PATCH] cache: sifive: Add bounds check for interrupt count in probe

[Conor Dooley]

From: Conor Dooley <conor.dooley@xxxxxxxxxxxxx>

On Thu, 29 Oct 2026 14:41:36 +0800, zhangjiao2 wrote:
> The sifive_ccache_probe() function uses platform_irq_count() to
> determine the number of interrupts and then iterates over them,
> storing each IRQ number into the global g_irq[] array which has
> a fixed size of SIFIVE_CCACHE_MAX_ECCINTR (4).
> 
> If the device tree defines more than 4 interrupts for the cache
> controller, the loop writes past the end of g_irq[], causing a
> buffer overflow in kernel BSS memory. This could corrupt adjacent
> global variables and potentially be exploited for privilege
> escalation.
> 
> [...]

Applied to riscv-soc-fixes, thanks!

[1/1] cache: sifive: Add bounds check for interrupt count in probe
      https://git.kernel.org/conor/c/56ca3e2f00b6

Thanks,
Conor.