Re: [PATCH RFC] irqchip: crossbar: Fix data race in allocate_gic_irq

[Marc Zyngier]

On Tue, 09 Jun 2026 22:00:09 +0100,
Bhargav Joshi <j.bhargav.u@xxxxxxxxx> wrote:
> 
> In allocate_gic_irq(), if irq_domain_alloc_irqs_parent() fails, the
> error path resets cb->irq_map[i] to IRQ_FREE. It modifies cb->irq_map[]
> without holding cb->lock. modifying without lock could cause data race.
> 
> Fix this by acquiring raw_spin_lock around cb->irq_map[] modification.
> 
> Fixes: 783d31863fb8 ("irqchip: crossbar: Convert dra7 crossbar to stacked domains")
> 
> Signed-off-by: Bhargav Joshi <j.bhargav.u@xxxxxxxxx>
> ---
> This bug was flagged by the Sashiko AI bot during the review process for
> the DT schema conversion of ti,irq-crossbar binding.
> https://lore.kernel.org/linux-devicetree/20260605210647.CCC881F00893@xxxxxxxxxxxxxxx/
> ---
>  drivers/irqchip/irq-crossbar.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
> index cd1134101ace..9b809e711009 100644
> --- a/drivers/irqchip/irq-crossbar.c
> +++ b/drivers/irqchip/irq-crossbar.c
> @@ -100,8 +100,11 @@ static int allocate_gic_irq(struct irq_domain *domain, unsigned virq,
>  	fwspec.param[2] = IRQ_TYPE_LEVEL_HIGH;
>  
>  	err = irq_domain_alloc_irqs_parent(domain, virq, 1, &fwspec);
> -	if (err)
> +	if (err) {
> +		raw_spin_lock(&cb->lock);
>  		cb->irq_map[i] = IRQ_FREE;
> +		raw_spin_lock(&cb->lock);

Really?

	M.

-- 
Without deviation from the norm, progress is not possible.