linux-kernel - Re: [PATCH] irqchip/loongson-pch-msi: Fix off-by-one on allocation error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 30 Mar 2024 11:38:40 +0000
From: Jiaxun Yang <jiaxun.yang@...goat.com>
To: Zenghui Yu <yuzenghui@...wei.com>, linux-mips@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: tglx@...utronix.de, maz@...nel.org, wanghaibin.wang@...wei.com,
 Huacai Chen <chenhuacai@...nel.org>
Subject: Re: [PATCH] irqchip/loongson-pch-msi: Fix off-by-one on allocation
 error path



在 2024/3/27 14:23, Zenghui Yu 写道:
> When pch_msi_parent_domain_alloc() returns an error, there is an off-by-one
> in the number of IRQs to be freed.
>
> Fix it by passing the number of successfully allocated IRQs, instead of the
> relative index of the last allocated one.
>
> Fixes: 632dcc2c75ef ("irqchip: Add Loongson PCH MSI controller")
> Cc: Huacai Chen <chenhuacai@...nel.org>
> Cc: Jiaxun Yang <jiaxun.yang@...goat.com>
> Signed-off-by: Zenghui Yu <yuzenghui@...wei.com>

Reviewed-by: Jiaxun Yang <jiaxun.yang@...goat.com>


I copied that piece of code from another driver without thinking.

Good catch!
> ---
>   drivers/irqchip/irq-loongson-pch-msi.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/irqchip/irq-loongson-pch-msi.c b/drivers/irqchip/irq-loongson-pch-msi.c
> index 6e1e1f011bb2..dd4d699170f4 100644
> --- a/drivers/irqchip/irq-loongson-pch-msi.c
> +++ b/drivers/irqchip/irq-loongson-pch-msi.c
> @@ -136,7 +136,7 @@ static int pch_msi_middle_domain_alloc(struct irq_domain *domain,
>   
>   err_hwirq:
>   	pch_msi_free_hwirq(priv, hwirq, nr_irqs);
> -	irq_domain_free_irqs_parent(domain, virq, i - 1);
> +	irq_domain_free_irqs_parent(domain, virq, i);
>   
>   	return err;
>   }