Commit eb737b8f authored Jun 04, 2019 by Peter Ujfalusi Committed by Marc Zyngier Jun 05, 2019

irqchip/ti-sci-inta: Fix kernel crash if irq_create_fwspec_mapping fail



irq_create_fwspec_mapping() can fail, returning 0 as parent_virq. In this
case vint_desc is going to be NULL in ti_sci_inta_alloc_irq() which will
cause NULL pointer dereference.

Also note that irq_create_fwspec_mapping() returns 'unsigned int' so the
check '<=' was wrong.

Use -EINVAL if irq_create_fwspec_mapping() returned with 0.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>

parent db56c512

drivers/irqchip/irq-ti-sci-inta.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -159,9 +159,9 @@ static struct ti_sci_inta_vint_desc *ti_sci_inta_alloc_parent_irq(struct irq_dom
		parent_fwspec.param[1] = vint_desc->vint_id;

		parent_virq = irq_create_fwspec_mapping(&parent_fwspec);
		if (parent_virq <= 0) {
		if (parent_virq == 0) {
		kfree(vint_desc);
		return ERR_PTR(parent_virq);
		return ERR_PTR(-EINVAL);
		}
		vint_desc->parent_virq = parent_virq;

Admin message