+ powerpc-xive-fix-use-after-free-of-xive_ipis.patch added to mm-nonmm-unstable branch

The patch titled
     Subject: powerpc/xive: fix use-after-free of xive_ipis
has been added to the -mm mm-nonmm-unstable branch.  Its filename is
     powerpc-xive-fix-use-after-free-of-xive_ipis.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/powerpc-xive-fix-use-after-free-of-xive_ipis.patch

This patch will later appear in the mm-nonmm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Gou Hao <[email protected]>
Subject: powerpc/xive: fix use-after-free of xive_ipis
Date: Fri, 24 Jul 2026 10:28:48 +0800

When irq_domain_alloc_irqs() fails in xive_init_ipis(), the error path
frees the global xive_ipis array via kfree().  However, xive_smp_probe()
ignores the error return and proceeds to call xive_setup_cpu_ipi(), which
dereferences the already-freed xive_ipis pointer, resulting in a
use-after-free.

Propagate the error from xive_init_ipis() through xive_smp_probe() and
check it in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup
is aborted cleanly on failure.

Link: https://lore.kernel.org/[email protected]
Fixes: 7dcc37b3eff9 ("powerpc/xive: Map one IPI interrupt per node")
Signed-off-by: Gou Hao <[email protected]>
Reviewed-by: Wentao Guan <[email protected]>
Reviewed-by: jiazhenyuan <[email protected]>
Reviewed-by: Cédric Le Goater <[email protected]>
Cc: Bharat Potnuri <[email protected]>
Cc: Dave Airlie <[email protected]>
Cc: Jason Gunthorpe <[email protected]>
Cc: Leon Romanovsky <[email protected]>
Cc: Maarten Lankhorst <[email protected]>
Cc: Madhavan Srinivasan <[email protected]>
Cc: Maxime Ripard <[email protected]>
Cc: Michael Ellerman <[email protected]>
Cc: Nam Cao <[email protected]>
Cc: Nicholas Piggin <[email protected]>
Cc: Nilay Shroff <[email protected]>
Cc: Shrikanth Hegde <[email protected]>
Cc: Thomas Zimemrmann <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
---

 arch/powerpc/platforms/powernv/smp.c |    8 +++++---
 arch/powerpc/platforms/pseries/smp.c |    8 +++++---
 arch/powerpc/sysdev/xive/common.c    |    6 +++++-
 3 files changed, 15 insertions(+), 7 deletions(-)

--- a/arch/powerpc/platforms/powernv/smp.c~powerpc-xive-fix-use-after-free-of-xive_ipis
+++ a/arch/powerpc/platforms/powernv/smp.c
@@ -332,10 +332,12 @@ static void pnv_cause_ipi(int cpu)
 
 static void __init pnv_smp_probe(void)
 {
-	if (xive_enabled())
-		xive_smp_probe();
-	else
+	if (xive_enabled()) {
+		if (xive_smp_probe() < 0)
+			return;
+	} else {
 		xics_smp_probe();
+	}
 
 	if (cpu_has_feature(CPU_FTR_DBELL)) {
 		ic_cause_ipi = smp_ops->cause_ipi;
--- a/arch/powerpc/platforms/pseries/smp.c~powerpc-xive-fix-use-after-free-of-xive_ipis
+++ a/arch/powerpc/platforms/pseries/smp.c
@@ -194,10 +194,12 @@ static int pseries_cause_nmi_ipi(int cpu
 
 static __init void pSeries_smp_probe(void)
 {
-	if (xive_enabled())
-		xive_smp_probe();
-	else
+	if (xive_enabled()) {
+		if (xive_smp_probe() < 0)
+			return;
+	} else {
 		xics_smp_probe();
+	}
 
 	/* No doorbell facility, must use the interrupt controller for IPIs */
 	if (!cpu_has_feature(CPU_FTR_DBELL))
--- a/arch/powerpc/sysdev/xive/common.c~powerpc-xive-fix-use-after-free-of-xive_ipis
+++ a/arch/powerpc/sysdev/xive/common.c
@@ -1256,10 +1256,14 @@ noinstr static void xive_cleanup_cpu_ipi
 
 int __init xive_smp_probe(void)
 {
+	int ret;
+
 	smp_ops->cause_ipi = xive_cause_ipi;
 
 	/* Register the IPI */
-	xive_init_ipis();
+	ret = xive_init_ipis();
+	if (ret < 0)
+		return ret;
 
 	/* Allocate and setup IPI for the boot CPU */
 	xive_setup_cpu_ipi(smp_processor_id());
_

Patches currently in -mm which might be from [email protected] are

powerpc-xive-remove-dead-null-check-after-gfp_nofail-allocation.patch
powerpc-xive-add-error-return-value-to-xive_smp_probe.patch
powerpc-xive-fix-use-after-free-of-xive_ipis.patch
drm-remove-dead-warn_on-null-check-after-gfp_nofail-allocation.patch
lib-test_hmm-remove-dead-null-checks-after-gfp_nofail-allocations.patch
rdma-cxgb4-remove-dead-null-checks-after-gfp_nofail-allocations.patch