The inclusive Device Tree IRQ range determines nr_irqs. Suspend and
resume then use nr_irqs to walk the fixed saved_status array, which has
MST_INTC_MAX_IRQS entries. A descending range underflows the unsigned
subtraction, while a range wider than 64 entries exceeds that array.
Reject both forms before deriving nr_irqs.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/irqchip/irq-mst-intc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c
index b5335f6fd6d6..1475335d668d 100644
--- a/drivers/irqchip/irq-mst-intc.c
+++ b/drivers/irqchip/irq-mst-intc.c
@@ -263,6 +263,10 @@ static int __init mst_intc_of_init(struct device_node *dn,
of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end))
return -EINVAL;
+ if (irq_end < irq_start ||
+ irq_end - irq_start >= MST_INTC_MAX_IRQS)
+ return -EINVAL;
+
cd = kzalloc_obj(*cd);
if (!cd)
return -ENOMEM;
--
2.43.0