linux-kernel - [PATCH] irqchip/sifive-plic: avoid interrupt ID 0 handling during suspend/resume

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250915162847.103445-1-lzampier@redhat.com>
Date: Mon, 15 Sep 2025 17:28:46 +0100
From: Lucas Zampieri <lzampier@...hat.com>
To: linux-kernel@...r.kernel.org
Cc: Lucas Zampieri <lzampier@...hat.com>,
	Paul Walmsley <paul.walmsley@...ive.com>,
	Samuel Holland <samuel.holland@...ive.com>,
	stable@...r.kernel.org,
	linux-riscv@...ts.infradead.org,
	Thomas Gleixner <tglx@...utronix.de>,
	Jia Wang <wangjia@...rarisc.com>
Subject: [PATCH] irqchip/sifive-plic: avoid interrupt ID 0 handling during suspend/resume

To: linux-kernel@...r.kernel.org
Cc: Paul Walmsley <paul.walmsley@...ive.com>
Cc: Samuel Holland <samuel.holland@...ive.com>
Cc: stable@...r.kernel.org
Cc: linux-riscv@...ts.infradead.org
Cc: Thomas Gleixner <tglx@...utronix.de>

According to the PLIC specification[1], global interrupt sources are
assigned small unsigned integer identifiers beginning at the value 1.
An interrupt ID of 0 is reserved to mean "no interrupt".

The current plic_irq_resume() and plic_irq_suspend() functions incorrectly
starts the loop from index 0, which could access the reserved interrupt ID
0 register space.
This fix changes the loop to start from index 1, skipping the reserved
interrupt ID 0 as per the PLIC specification.

This prevents potential undefined behavior when accessing the reserved
register space during suspend/resume cycles.

Fixes: e80f0b6a2cf3 ("irqchip/irq-sifive-plic: Add syscore callbacks for hibernation")
Co-developed-by: Jia Wang <wangjia@...rarisc.com>
Signed-off-by: Jia Wang <wangjia@...rarisc.com>
Signed-off-by: Lucas Zampieri <lzampier@...hat.com>

[1] https://github.com/riscv/riscv-plic-spec/releases/tag/1.0.0
---
 drivers/irqchip/irq-sifive-plic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
index bf69a4802b71..1c2b4d2575ac 100644
--- a/drivers/irqchip/irq-sifive-plic.c
+++ b/drivers/irqchip/irq-sifive-plic.c
@@ -252,7 +252,7 @@ static int plic_irq_suspend(void)
 
 	priv = per_cpu_ptr(&plic_handlers, smp_processor_id())->priv;
 
-	for (i = 0; i < priv->nr_irqs; i++) {
+	for (i = 1; i < priv->nr_irqs; i++) {
 		__assign_bit(i, priv->prio_save,
 			     readl(priv->regs + PRIORITY_BASE + i * PRIORITY_PER_ID));
 	}
@@ -283,7 +283,7 @@ static void plic_irq_resume(void)
 
 	priv = per_cpu_ptr(&plic_handlers, smp_processor_id())->priv;
 
-	for (i = 0; i < priv->nr_irqs; i++) {
+	for (i = 1; i < priv->nr_irqs; i++) {
 		index = BIT_WORD(i);
 		writel((priv->prio_save[index] & BIT_MASK(i)) ? 1 : 0,
 		       priv->regs + PRIORITY_BASE + i * PRIORITY_PER_ID);
-- 
2.51.0