[PATCH] irqchip/mst-intc: reject ranges beyond saved state capacity
Pengpeng Hou <[email protected]>
| Newsgroups | org.infradead.lists.linux-mediatek,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
The inclusive Device Tree IRQ range determines nr_irqs. Suspend and resume then use nr_irqs to walk the fixed saved_status array, which has MST_INTC_MAX_IRQS entries. A descending range underflows the unsigned subtraction, while a range wider than 64 entries exceeds that array. Reject both forms before deriving nr_irqs. Signed-off-by: Pengpeng Hou <[email protected]> --- drivers/irqchip/irq-mst-intc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c index b5335f6fd6d6..1475335d668d 100644 --- a/drivers/irqchip/irq-mst-intc.c +++ b/drivers/irqchip/irq-mst-intc.c @@ -263,6 +263,10 @@ static int __init mst_intc_of_init(struct device_node *dn, of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end)) return -EINVAL; + if (irq_end < irq_start || + irq_end - irq_start >= MST_INTC_MAX_IRQS) + return -EINVAL; + cd = kzalloc_obj(*cd); if (!cd) return -ENOMEM; -- 2.43.0