Re: [PATCH v2 0/3] irqchip/gic-v3: Memory-safety fixes on the probe paths

[Marc Zyngier]

On Fri, 25 Sep 2026 09:49:57 +0100,
Fuad Tabba <fuad.tabba@xxxxxxxxx> wrote:
> 
> Hi folks,
> 
> Changes since v1 [1]:
>   - Patch 3 marks the skipped CPU in broken_rdists, so it's kept
>     offline. (Marc, sashiko)
> 
> Three probe-time bugs in the GICv3 drivers. The kernel keeps running
> after each of them, so the memory involved is live rather than on the
> way to a reset.
> 
> The first two free memory an enabled ITS still points at. Boot carries
> on because its_init() discards a failed probe and gic_init_bases()
> discards what its_init() returns. The third is a write past the end of
> redist_regs[] for an enabled GICC with a zero GICR base, on a MADT with
> no GICR entries. fa2dabe57220e's commit message says such tables exist,
> and I haven't seen one.
> 
> Based on Linux 7.3-rc4 (93f51579e7df2).
> 
> Cheers,
> /fuad
> 
> [1] https://lore.kernel.org/all/20260924161514.1112730-1-fuad.tabba@xxxxxxxxx/
> 
> Fuad Tabba (3):
>   irqchip/gic-v3-its: Don't free a vPE table shared with another ITS
>   irqchip/gic-v3-its: Don't free the tables of an enabled ITS
>   irqchip/gic-v3: Don't register a redistributor that was never counted
> 
>  drivers/irqchip/irq-gic-v3-its.c | 16 +++++++++++-----
>  drivers/irqchip/irq-gic-v3.c     | 11 +++++++++++
>  2 files changed, 22 insertions(+), 5 deletions(-)
> 
> 
> base-commit: 93f51579e7df248780214094418f205253383cc5

Reviewed-by: Marc Zyngier <maz@xxxxxxxxxx>

	M.

-- 
Jazz isn't dead. It just smells funny.