linux-kernel - Re: [PATCH] irqchip/aslint-sswi: request IO memory resource

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260116124257.78357-1-clm@meta.com>
Date: Fri, 16 Jan 2026 04:42:49 -0800
From: Chris Mason <clm@...a.com>
To: Vladimir Kondratiev <vladimir.kondratiev@...ileye.com>
CC: Chris Mason <clm@...a.com>, Thomas Gleixner <tglx@...utronix.de>,
        Xu Lu
	<luxu.kernel@...edance.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] irqchip/aslint-sswi: request IO memory resource

On Tue,  9 Dec 2025 16:23:33 +0200 Vladimir Kondratiev <vladimir.kondratiev@...ileye.com> wrote:

> Make an aclint_sswi instance visible in the resource list,
> i.e. /proc/iomem
> 

Hi everyone,

I ran tip master through my AI review prompts, and this one was flagged.
This is a lot of words for NULL vs ERR_PTR, but it looks right to me:

> diff --git a/drivers/irqchip/irq-aclint-sswi.c b/drivers/irqchip/irq-aclint-sswi.c
> index fee30f3bc5ac2..325501f34a9bc 100644
> --- a/drivers/irqchip/irq-aclint-sswi.c
> +++ b/drivers/irqchip/irq-aclint-sswi.c
> @@ -109,7 +109,7 @@ static int __init aclint_sswi_probe(struct fwnode_handle *fwnode)
>  	if (!is_of_node(fwnode))
>  		return -EINVAL;
>
> -	reg = of_iomap(to_of_node(fwnode), 0);
> +	reg = of_io_request_and_map(to_of_node(fwnode), 0, NULL);
>  	if (!reg)
>  		return -ENOMEM;

Should this error check be updated? of_iomap() returns NULL on failure,
but of_io_request_and_map() returns IOMEM_ERR_PTR() on failure which is
non-NULL.

When of_io_request_and_map() fails, the condition (!reg) will be false
and the function continues with an invalid ERR_PTR value. This gets passed
to aclint_sswi_parse_irq() which stores (reg + offset) into per_cpu
sswi_cpu_regs, leading to a crash when IPIs are later sent.

Other callers of of_io_request_and_map() in drivers/irqchip/ use IS_ERR()
for the error check. For example, sun6i_r_intc_init() in irq-sun6i-r.c:

    base = of_io_request_and_map(node, 0, NULL);
    if (IS_ERR(base)) {
        pr_err("%pOF: Failed to map MMIO region\n", node);
        return PTR_ERR(base);
    }