[PATCH RFC 08/15] arm_mpam: Fix ris_idx type to prevent range check bypass on truncation

Yin Li <[email protected]>
Newsgroups dev.linux.lists.driver-core,org.kernel.vger.linux-arm-msm,org.kernel.vger.linux-devicetree,org.kernel.vger.linux-kernel
Message-ID <20260811-mpam-resctrl-dt-knp-support-v1-8-ea6397bead59@oss.qualcomm.com>
The RIS index is read from device tree as u64 via of_property_read_reg(),
but was narrowed to u32 when passed to mpam_dt_parse_resource() and
further to u8 when passed to mpam_ris_create(). A value exceeding
MPAM_MSC_MAX_NUM_RIS could be silently truncated to a small index that
passes the range check in mpam_ris_create_locked(), leading to incorrect
RIS creation.

Widen the ris_idx parameter through mpam_dt_parse_resource(),
mpam_ris_create_locked(), and mpam_ris_create() to u64 so the value
is preserved until the range check in mpam_ris_create_locked() rejects
out-of-range indices.

Signed-off-by: Yin Li <[email protected]>
---
 drivers/resctrl/mpam_devices.c | 6 +++---
 include/linux/arm_mpam.h       | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c
index cc9fa1d78925..1e082fb60e30 100644
--- a/drivers/resctrl/mpam_devices.c
+++ b/drivers/resctrl/mpam_devices.c
@@ -260,7 +260,7 @@ static int mpam_dt_count_msc(void)
 }
 
 static int mpam_dt_parse_resource(struct mpam_msc *msc, struct device_node *np,
-				  u32 ris_idx)
+				  u64 ris_idx)
 {
 	int err = 0;
 	u32 class_id = 0;
@@ -712,7 +712,7 @@ static int mpam_ris_get_affinity(struct mpam_msc *msc, cpumask_t *affinity,
 	return 0;
 }
 
-static int mpam_ris_create_locked(struct mpam_msc *msc, u8 ris_idx,
+static int mpam_ris_create_locked(struct mpam_msc *msc, u64 ris_idx,
 				  enum mpam_class_types type, u8 class_id,
 				  int component_id)
 {
@@ -799,7 +799,7 @@ static void mpam_ris_destroy(struct mpam_msc_ris *ris)
 		mpam_vmsc_destroy(vmsc);
 }
 
-int mpam_ris_create(struct mpam_msc *msc, u8 ris_idx,
+int mpam_ris_create(struct mpam_msc *msc, u64 ris_idx,
 		    enum mpam_class_types type, u8 class_id, int component_id)
 {
 	int err;
diff --git a/include/linux/arm_mpam.h b/include/linux/arm_mpam.h
index f92a36187a52..30461cd71199 100644
--- a/include/linux/arm_mpam.h
+++ b/include/linux/arm_mpam.h
@@ -39,10 +39,10 @@ static inline int acpi_mpam_count_msc(void) { return -EINVAL; }
 #endif
 
 #ifdef CONFIG_ARM64_MPAM_DRIVER
-int mpam_ris_create(struct mpam_msc *msc, u8 ris_idx,
+int mpam_ris_create(struct mpam_msc *msc, u64 ris_idx,
 		    enum mpam_class_types type, u8 class_id, int component_id);
 #else
-static inline int mpam_ris_create(struct mpam_msc *msc, u8 ris_idx,
+static inline int mpam_ris_create(struct mpam_msc *msc, u64 ris_idx,
 				  enum mpam_class_types type, u8 class_id,
 				  int component_id)
 {

-- 
2.34.1
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.