linux-kernel - [PATCH] irqchip/msi-lib: Fix fwnode refcount in msi_lib_irq_domain

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250804145553.795065-1-lpieralisi@kernel.org>
Date: Mon,  4 Aug 2025 16:55:53 +0200
From: Lorenzo Pieralisi <lpieralisi@...nel.org>
To: linux-kernel@...r.kernel.org
Cc: linux-arm-kernel@...ts.infradead.org,
	Lorenzo Pieralisi <lpieralisi@...nel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Rob Herring <robh@...nel.org>,
	"Rafael J. Wysocki" <rafael@...nel.org>,
	Marc Zyngier <maz@...nel.org>
Subject: [PATCH] irqchip/msi-lib: Fix fwnode refcount in msi_lib_irq_domain_select()

Commit 8b65db1e93a2 ("irqchip/msi-lib: Add IRQ_DOMAIN_FLAG_FWNODE_PARENT
handling") added logic in msi_lib_irq_domain_select() to match the
domain fwnode against the fwnode parent of the fwspec.fwnode.

The fwnode_get_parent() caller must call fwnode_handle_put() on the
returned pointer value, lest fwnode refcounting for the parent ends
up being out of kilter.

Fix this by relying on the fwnode_handle clean-up handlers and by
incrementing the fwnode refcount regardless of whether we use
parent matching or not (the domain selection code already holds a
reference before calling msi_lib_irq_domain_select() but to make
the exit path more uniform if IRQ_DOMAIN_FLAG_FWNODE_PARENT is not
set fwnode_handle_get() is called again on fwspec.fwnode so that
the clean-up code is the same for the two matching patterns).

Fixes: 8b65db1e93a2 ("irqchip/msi-lib: Add IRQ_DOMAIN_FLAG_FWNODE_PARENT handling")
Signed-off-by: Lorenzo Pieralisi <lpieralisi@...nel.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Rob Herring <robh@...nel.org>
Cc: "Rafael J. Wysocki" <rafael@...nel.org>
Cc: Marc Zyngier <maz@...nel.org>
---
Hi Thomas, Marc,

Noticed while adding GICv5 ACPI support - I tested this patch on arm64 with
DT (GICv5 and v3) and ACPI (GICv3).

msi_lib_irq_domain_select() is used in other arches, I could not
test on those (don't know if they have non-[DT/irqchip/acpi] specific
fwnodes) - from a fwnode interface perspective I think that this patch
does the right thing, it should not add any issue to existing code
to the best of my knowledge but it has to be verified.

Thanks,
Lorenzo

 drivers/irqchip/irq-msi-lib.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/irqchip/irq-msi-lib.c b/drivers/irqchip/irq-msi-lib.c
index 454c7f16dd4d..908944009c21 100644
--- a/drivers/irqchip/irq-msi-lib.c
+++ b/drivers/irqchip/irq-msi-lib.c
@@ -133,13 +133,13 @@ int msi_lib_irq_domain_select(struct irq_domain *d, struct irq_fwspec *fwspec,
 {
 	const struct msi_parent_ops *ops = d->msi_parent_ops;
 	u32 busmask = BIT(bus_token);
-	struct fwnode_handle *fwh;

 	if (!ops)
 		return 0;

-	fwh = d->flags & IRQ_DOMAIN_FLAG_FWNODE_PARENT ? fwnode_get_parent(fwspec->fwnode)
-						       : fwspec->fwnode;
+	struct fwnode_handle *fwh __free(fwnode_handle) =
+		d->flags & IRQ_DOMAIN_FLAG_FWNODE_PARENT ? fwnode_get_parent(fwspec->fwnode)
+							 : fwnode_handle_get(fwspec->fwnode);
 	if (fwh != d->fwnode || fwspec->param_count != 0)
 		return 0;

-- 
2.48.0