From nobody Sat Jul 25 04:30:46 2026 Received: from cstnet.cn (smtp81.cstnet.cn [159.226.251.81]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D2A2F1427A for ; Sat, 18 Jul 2026 04:33:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.81 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784349221; cv=none; b=eVrKcjHyrndYQbW6u2znPU+xSfNPZuDYv6LcP41Hvt1oTuFxVJropmb0p1lD8NV2kyGCg+zefOZ6yt5Xj48j1b2zh+itBbX1PHnoI2JRUMXBcKEIw7flsHN3EisB53+/6u1Z5MeHNfAYXUgdKHwKDtM0ZBIu2ODORhAjF4cxIKE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784349221; c=relaxed/simple; bh=e7xTY6L7CIJQer4+Ru9zVrl84dwlG2oyJfT6Vp8oCiI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=mtPAQWg0yOF3Cl9WUv1wFwZ3KbhiisGJTAulbHzxXsXep+8E8XKfXKU0aI534Hg1vILOoqPpx3TbiLB3+232PDEywze1wyZDhahUTL+DRlm6OTcVlRLivMSluYye1nnQrFoUJwMgl7CyU1X9lt1Wnb1oM6CekvEL2+RZs7Tac8w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.81 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.245.140]) by APP-03 (Coremail) with SMTP id rQCowABXYkAWAltqYkYuAA--.39012S2; Sat, 18 Jul 2026 12:33:27 +0800 (CST) From: Pengpeng Hou To: Anup Patel Cc: Pengpeng Hou , Thomas Gleixner , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] irqchip/riscv-aplic: Validate translated source IDs Date: Sat, 18 Jul 2026 12:33:26 +0800 Message-ID: <20260718040000.003.797eee8b-caplitmus-rv@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: rQCowABXYkAWAltqYkYuAA--.39012S2 X-Coremail-Antispam: 1UD129KBjvJXoWxAryDWFy5AFW8XF4UWw1Utrb_yoWruw1kpF 4UJ3yavr40yF17Wr17Cw48Za43G3WjyayDtasIvwnaq3s0kFWDCFsFkrZ09r13Gr4UGas8 Can3JFW8u3W5AFDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9214x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r1I6r4UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j 6F4UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr 1j6F4UJwAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv 7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r 1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02 628vn2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4 IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1r MI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJV WUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6r1j 6r1xMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYx BIdaVFxhVjvjDU0xZFpf9x0JUd-B_UUUUU= X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Content-Type: text/plain; charset="utf-8" APLIC source IDs are in the range 1..riscv,num-sources. Device Tree interrupt specifiers contain a source ID directly, while ACPI specifiers contain a GSI that must first be translated by subtracting gsi_base. The shared helper currently checks only whether the raw specifier is zero. An ACPI GSI equal to gsi_base therefore becomes source ID zero, a GSI below gsi_base underflows, and either firmware interface can provide a source ID above the configured count. These values later reach d->hwirq - 1 register and saved-state indexing. Pass the configured source count to the shared helper and validate the translated ID before returning it. This covers both direct and MSI modes. Fixes: 2333df5ae51e ("irqchip: Add RISC-V advanced PLIC driver for direct-m= ode") Signed-off-by: Pengpeng Hou --- drivers/irqchip/irq-riscv-aplic-direct.c | 6 ++++-- drivers/irqchip/irq-riscv-aplic-main.c | 8 +++++--- drivers/irqchip/irq-riscv-aplic-main.h | 3 ++- drivers/irqchip/irq-riscv-aplic-msi.c | 3 ++- 4 files changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/irqchip/irq-riscv-aplic-direct.c b/drivers/irqchip/irq= -riscv-aplic-direct.c index 5a9650225dd80..eb46d9a219e10 100644 --- a/drivers/irqchip/irq-riscv-aplic-direct.c +++ b/drivers/irqchip/irq-riscv-aplic-direct.c @@ -97,7 +97,8 @@ static int aplic_direct_irqdomain_translate(struct irq_do= main *d, struct irq_fws { struct aplic_priv *priv =3D d->host_data; =20 - return aplic_irqdomain_translate(fwspec, priv->gsi_base, hwirq, type); + return aplic_irqdomain_translate(fwspec, priv->gsi_base, priv->nr_irqs, + hwirq, type); } =20 static int aplic_direct_irqdomain_alloc(struct irq_domain *domain, unsigne= d int virq, @@ -110,7 +111,8 @@ static int aplic_direct_irqdomain_alloc(struct irq_doma= in *domain, unsigned int unsigned int type; int i, ret; =20 - ret =3D aplic_irqdomain_translate(fwspec, priv->gsi_base, &hwirq, &type); + ret =3D aplic_irqdomain_translate(fwspec, priv->gsi_base, priv->nr_irqs, + &hwirq, &type); if (ret) return ret; =20 diff --git a/drivers/irqchip/irq-riscv-aplic-main.c b/drivers/irqchip/irq-r= iscv-aplic-main.c index d9afb6ae98cf5..2284dbaea449d 100644 --- a/drivers/irqchip/irq-riscv-aplic-main.c +++ b/drivers/irqchip/irq-riscv-aplic-main.c @@ -235,15 +235,17 @@ int aplic_irq_set_type(struct irq_data *d, unsigned i= nt type) } =20 int aplic_irqdomain_translate(struct irq_fwspec *fwspec, u32 gsi_base, - unsigned long *hwirq, unsigned int *type) + u32 nr_irqs, unsigned long *hwirq, + unsigned int *type) { if (WARN_ON(fwspec->param_count < 2)) return -EINVAL; - if (WARN_ON(!fwspec->param[0])) - return -EINVAL; =20 /* For DT, gsi_base is always zero. */ *hwirq =3D fwspec->param[0] - gsi_base; + if (WARN_ON(!*hwirq || *hwirq > nr_irqs)) + return -EINVAL; + *type =3D fwspec->param[1] & IRQ_TYPE_SENSE_MASK; =20 WARN_ON(*type =3D=3D IRQ_TYPE_NONE); diff --git a/drivers/irqchip/irq-riscv-aplic-main.h b/drivers/irqchip/irq-r= iscv-aplic-main.h index 2d8ad7138541a..8d4010e7149be 100644 --- a/drivers/irqchip/irq-riscv-aplic-main.h +++ b/drivers/irqchip/irq-riscv-aplic-main.h @@ -55,7 +55,8 @@ void aplic_irq_unmask(struct irq_data *d); void aplic_irq_mask(struct irq_data *d); int aplic_irq_set_type(struct irq_data *d, unsigned int type); int aplic_irqdomain_translate(struct irq_fwspec *fwspec, u32 gsi_base, - unsigned long *hwirq, unsigned int *type); + u32 nr_irqs, unsigned long *hwirq, + unsigned int *type); void aplic_init_hw_global(struct aplic_priv *priv, bool msi_mode); int aplic_setup_priv(struct aplic_priv *priv, struct device *dev, void __i= omem *regs); void aplic_direct_restore_states(struct aplic_priv *priv); diff --git a/drivers/irqchip/irq-riscv-aplic-msi.c b/drivers/irqchip/irq-ri= scv-aplic-msi.c index fb8d1838609fb..665840e2c3919 100644 --- a/drivers/irqchip/irq-riscv-aplic-msi.c +++ b/drivers/irqchip/irq-riscv-aplic-msi.c @@ -140,7 +140,8 @@ static int aplic_msi_translate(struct irq_domain *d, st= ruct irq_fwspec *fwspec, struct msi_domain_info *info =3D d->host_data; struct aplic_priv *priv =3D info->data; =20 - return aplic_irqdomain_translate(fwspec, priv->gsi_base, hwirq, type); + return aplic_irqdomain_translate(fwspec, priv->gsi_base, priv->nr_irqs, + hwirq, type); } =20 static const struct msi_domain_template aplic_msi_template =3D { --=20 2.43.0