[tip: irq/drivers] irqchip/gic-v3-its: Don't WARN on LPI free allocation failure

[tip-bot2 for Karl Mehltretter]

The following commit has been merged into the irq/drivers branch of tip:

Commit-ID:     135d9e67f7ab4f261c2157ee2de1f93a4de39a41
Gitweb:        https://git.kernel.org/tip/135d9e67f7ab4f261c2157ee2de1f93a4de39a41
Author:        Karl Mehltretter <kmehltretter@xxxxxxxxx>
AuthorDate:    Tue, 11 Aug 2026 11:55:32 +02:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Mon, 07 Sep 2026 21:53:05 +02:00

irqchip/gic-v3-its: Don't WARN on LPI free allocation failure

free_lpi_range() cannot give LPIs back to the allocator without
allocating a struct lpi_range to describe the freed range, so it
returns -ENOMEM (its only failure mode) when that allocation fails,
and its_lpi_free() turns this into a WARN_ON().

syzbot triggers the WARN_ON() by injecting a slab allocation failure
on device teardown, which with panic_on_warn becomes a panic:

  WARNING: drivers/irqchip/irq-gic-v3-its.c:2251 at its_msi_teardown+0x3a4/0x424
   its_msi_teardown+0x3a4/0x424
   msi_remove_device_irq_domain+0x16c/0x27c
   msi_device_data_release+0x38/0x9c

The failure is transient and the consequence benign: the freed range
is simply never returned to the allocator. This does not warrant a
WARN_ON() backtrace, so log a rate-limited error instead.

Fixes: 880cb3cddd16 ("irqchip/gic-v3-its: Refactor LPI allocator")
Reported-by: syzbot+229d761b8a110e6de517@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Assisted-by: Claude:claude-fable-5
Link: https://patch.msgid.link/20260811095532.48454-1-kmehltretter@xxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=229d761b8a110e6de517
---
 drivers/irqchip/irq-gic-v3-its.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index e9807af..b0fdc2b 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2248,7 +2248,8 @@ out:
 
 static void its_lpi_free(unsigned long *bitmap, u32 base, u32 nr_ids)
 {
-	WARN_ON(free_lpi_range(base, nr_ids));
+	if (free_lpi_range(base, nr_ids))
+		pr_err_ratelimited("ITS: failed to free LPI range %u:%u\n", base, nr_ids);
 	bitmap_free(bitmap);
 }