Re: [tip: irq/drivers] irqchip/imx-irqsteer: Validate IRQ count before creating domain

[Borislav Petkov]

On Sun, Nov 08, 2026 at 09:49:39PM -0000, tip-bot2 for Fabio Estevam wrote:
> The following commit has been merged into the irq/drivers branch of tip:
> 
> Commit-ID:     f99f3c4acaff0df9393c1e6a3f28b7b974e01d95
> Gitweb:        https://git.kernel.org/tip/f99f3c4acaff0df9393c1e6a3f28b7b974e01d95
> Author:        Fabio Estevam <festevam@xxxxxxxxxxxx>
> AuthorDate:    Wed, 04 Nov 2026 16:37:50 +09:00
> Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
> CommitterDate: Sun, 08 Nov 2026 22:43:43 +01:00
> 
> irqchip/imx-irqsteer: Validate IRQ count before creating domain
> 
> The IRQ count is validated after creating the IRQ domain. If it is
> invalid, probe returns without removing the domain, leaving its host
> data pointing at devm-managed memory that is freed on probe failure.
> 
> Validate the count before allocating resources to avoid the leak and
> dangling pointer.
> 
> Fixes: 28528fca4908 ("irqchip/imx-irqsteer: Add multi output interrupts support")
> Signed-off-by: Fabio Estevam <festevam@xxxxxxxxxxxx>
> Signed-off-by: Zhipeng Wang <zhipeng.wang_1@xxxxxxx>
> Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
> Reviewed-by: Frank Li <Frank.Li@xxxxxxx>
> Reviewed-by: Radu Rendec <radu@xxxxxxxxxx>
> Link: https://patch.msgid.link/20261104073759.386777-3-Zhipeng.wang_1@xxxxxxxxxxx
> ---
>  drivers/irqchip/irq-imx-irqsteer.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/irqchip/irq-imx-irqsteer.c b/drivers/irqchip/irq-imx-irqsteer.c
> index 1b8d0c8..766756e 100644
> --- a/drivers/irqchip/irq-imx-irqsteer.c
> +++ b/drivers/irqchip/irq-imx-irqsteer.c
> @@ -218,6 +218,8 @@ static int imx_irqsteer_probe(struct platform_device *pdev)
>  	 */
>  	data->irq_count = DIV_ROUND_UP(irqs_num, 64);
>  	data->reg_num = irqs_num / 32;
> +	if (!data->irq_count || data->irq_count > CHAN_MAX_OUTPUT_INT)
> +		return -EINVAL;
>  
>  	if (IS_ENABLED(CONFIG_PM)) {
>  		data->saved_reg = devm_kzalloc(&pdev->dev,
> @@ -246,11 +248,6 @@ static int imx_irqsteer_probe(struct platform_device *pdev)
>  	}
>  	irq_domain_set_pm_device(data->domain, &pdev->dev);
>  
> -	if (!data->irq_count || data->irq_count > CHAN_MAX_OUTPUT_INT) {
> -		ret = -EINVAL;
> -		goto out;
> -	}
> -
>  	for (i = 0; i < data->irq_count; i++) {
>  		data->irq[i] = irq_of_parse_and_map(np, i);
>  		if (!data->irq[i])

I'm guessing it is this one because it removes the "goto out;" around the
2xx-ish linenumbers but forgets to remove the out: label itself:

drivers/irqchip/irq-imx-irqsteer.c: In function ‘imx_irqsteer_probe’:
drivers/irqchip/irq-imx-irqsteer.c:271:1: error: label ‘out’ defined but not used [-Werror=unused-label]
  271 | out:
      | ^~~
cc1: all warnings being treated as errors
make[4]: *** [scripts/Makefile.build:290: drivers/irqchip/irq-imx-irqsteer.o] Error 1
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:572: drivers/irqchip] Error 2
make[3]: *** Waiting for unfinished jobs....

An allmodconfig x86_64.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette