Commit 4e412160 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'irq_urgent_for_v6.10_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull irq fixes from Borislav Petkov:

 - Make sure multi-bridge machines get all eiointc interrupt controllers
   initialized even if the number of CPUs has been limited by a cmdline
   param

 - Make sure interrupt lines on liointc hw are configured properly even
   when interrupt routing changes

 - Avoid use-after-free in the error path of the MSI init code

* tag 'irq_urgent_for_v6.10_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  PCI/MSI: Fix UAF in msi_capability_init
  irqchip/loongson-liointc: Set different ISRs for different cores
  irqchip/loongson-eiointc: Use early_cpu_to_node() instead of cpu_to_node()
parents 03c8b0bd 9eee5330

drivers/irqchip/irq-loongson-eiointc.c

+3 −2
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
#include <linux/irqchip/chained_irq.h>

#include <linux/kernel.h>

#include <linux/syscore_ops.h>

#include <asm/numa.h>



#define EIOINTC_REG_NODEMAP	0x14a0

#define EIOINTC_REG_IPMAP	0x14c0
@@ -339,7 +340,7 @@ static int __init pch_msi_parse_madt(union acpi_subtable_headers *header, 
	int node;



	if (cpu_has_flatmode)

		node = cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE);

		node = early_cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE);

	else

		node = eiointc_priv[nr_pics - 1]->node;
@@ -431,7 +432,7 @@ int __init eiointc_acpi_init(struct irq_domain *parent, 
		goto out_free_handle;



	if (cpu_has_flatmode)

		node = cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE);

		node = early_cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE);

	else

		node = acpi_eiointc->node;

	acpi_set_vec_parent(node, priv->eiointc_domain, pch_group);

drivers/irqchip/irq-loongson-liointc.c

+2 −2
Original line number Diff line number Diff line
@@ -28,7 +28,7 @@ 


#define LIOINTC_INTC_CHIP_START	0x20



#define LIOINTC_REG_INTC_STATUS	(LIOINTC_INTC_CHIP_START + 0x20)

#define LIOINTC_REG_INTC_STATUS(core)	(LIOINTC_INTC_CHIP_START + 0x20 + (core) * 8)

#define LIOINTC_REG_INTC_EN_STATUS	(LIOINTC_INTC_CHIP_START + 0x04)

#define LIOINTC_REG_INTC_ENABLE	(LIOINTC_INTC_CHIP_START + 0x08)

#define LIOINTC_REG_INTC_DISABLE	(LIOINTC_INTC_CHIP_START + 0x0c)
@@ -217,7 +217,7 @@ static int liointc_init(phys_addr_t addr, unsigned long size, int revision, 
		goto out_free_priv;



	for (i = 0; i < LIOINTC_NUM_CORES; i++)

		priv->core_isr[i] = base + LIOINTC_REG_INTC_STATUS;

		priv->core_isr[i] = base + LIOINTC_REG_INTC_STATUS(i);



	for (i = 0; i < LIOINTC_NUM_PARENT; i++)

		priv->handler[i].parent_int_map = parent_int_map[i];

drivers/pci/msi/msi.c

+8 −2
Original line number Diff line number Diff line
@@ -352,7 +352,7 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, 
			       struct irq_affinity *affd)

{

	struct irq_affinity_desc *masks = NULL;

	struct msi_desc *entry;

	struct msi_desc *entry, desc;

	int ret;



	/* Reject multi-MSI early on irq domain enabled architectures */
@@ -377,6 +377,12 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, 
	/* All MSIs are unmasked by default; mask them all */

	entry = msi_first_desc(&dev->dev, MSI_DESC_ALL);

	pci_msi_mask(entry, msi_multi_mask(entry));

	/*

	 * Copy the MSI descriptor for the error path because

	 * pci_msi_setup_msi_irqs() will free it for the hierarchical

	 * interrupt domain case.

	 */

	memcpy(&desc, entry, sizeof(desc));



	/* Configure MSI capability structure */

	ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI);
@@ -396,7 +402,7 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, 
	goto unlock;



err:

	pci_msi_unmask(entry, msi_multi_mask(entry));

	pci_msi_unmask(&desc, msi_multi_mask(&desc));

	pci_free_msi_irqs(dev);

fail:

	dev->msi_enabled = 0;