[tip: irq/urgent] irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing

[tip-bot2 for Lorenzo Pieralisi]

The following commit has been merged into the irq/urgent branch of tip:

Commit-ID:     328affc639ce9873a7a0a3fd6b8339f19767529b
Gitweb:        https://git.kernel.org/tip/328affc639ce9873a7a0a3fd6b8339f19767529b
Author:        Lorenzo Pieralisi <lpieralisi@xxxxxxxxxx>
AuthorDate:    Wed, 12 Aug 2026 11:10:29 +02:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Thu, 20 Aug 2026 10:23:53 +02:00

irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing

In gic_acpi_parse_iaffid() a given MADT GICC entry might not correspond
to a logical cpu recognized by the kernel, resulting in the cpu variable
initialization to an error value.

Currently, the get_logical_index() return value is not checked for failure,
which might result in out-of-bounds memory corruption while trying to
index a per_cpu variable array.

Add a check to evaluate get_logical_index() return value.

Fixes: 35866efa52fe ("irqchip/gic-v5: Add ACPI IRS probing")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@xxxxxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Link: https://sashiko.dev/#/message/20260810104747.E5CE71F000E9%40smtp.kernel.org
Link: https://patch.msgid.link/20260812-gicv5-7-2-fixes-v1-1-3743e82c69a4@xxxxxxxxxx
---
 drivers/irqchip/irq-gic-v5-irs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 3028a8b..0bd9ae9 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -874,6 +874,8 @@ static int __init gic_acpi_parse_iaffid(union acpi_subtable_headers *header,
 		return 0;
 
 	cpu = get_logical_index(gicc->arm_mpidr);
+	if (cpu < 0)
+		return 0;
 
 	if (gicc->iaffid & ~GENMASK(current_iaffid_bits - 1, 0)) {
 		pr_warn("CPU %d iaffid 0x%x exceeds IRS iaffid bits\n", cpu, gicc->iaffid);