linux-kernel - [PATCH] of/irq: Refuse to of_irq_parse_one() more than one IRQ if #interrupt-cells = <0>

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250307135231.4080272-1-alexander.sverdlin@siemens.com>
Date: Fri,  7 Mar 2025 14:52:18 +0100
From: "A. Sverdlin" <alexander.sverdlin@...mens.com>
To: devicetree@...r.kernel.org
Cc: Alexander Sverdlin <alexander.sverdlin@...mens.com>,
	Rob Herring <robh@...nel.org>,
	Saravana Kannan <saravanak@...gle.com>,
	linux-kernel@...r.kernel.org
Subject: [PATCH] of/irq: Refuse to of_irq_parse_one() more than one IRQ if #interrupt-cells = <0>

From: Alexander Sverdlin <alexander.sverdlin@...mens.com>

An #interrupt-cells = <0> property may arguably be a right answer for an
interrupt controller having just one interrupt and no options to configure.
There are anyway already existing examples in the tree, both in DTs and in
the bindings.

Now the problem is that of_irq_count() called on an interrupt generating
device having one of the former controllers as parent would result in an
endless loop. It's especially unpleasant in the startup where
of_irq_count() <= ... <= of_platform_default_populate_init() will silently
hang forever (unless a watchdog bites).

Prevent others from spending the same time on debugging this by refusing to
parse more than one IRQ for such controllers.

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@...mens.com>
---
 drivers/of/irq.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 6c843d54ebb11..b3a359c7641d3 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -381,6 +381,13 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
 		goto out;
 	}

+	if (!intsize && index) {
+		pr_debug("%pOF trying to map IRQ %d in %pOF having #interrupt-cells = <0>\n",
+			 device, index, p);
+		res = -EINVAL;
+		goto out;
+	}
+
 	pr_debug(" parent=%pOF, intsize=%d\n", p, intsize);

 	/* Copy intspec into irq structure */
-- 
2.48.1