[irqchip: irq/irqchip-next] irqchip/ti-sci-intr: Fix freeing of irqs

[irqchip: irq/irqchip-next] irqchip/ti-sci-intr: Fix freeing of irqs

[irqchip-bot for Lokesh Vutla]

The following commit has been merged into the irq/irqchip-next branch of irqchip:

Commit-ID:     fc6c7cd3878641fd43189f15697e7ad0871f5c1a
Gitweb:        https://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms/fc6c7cd3878641fd43189f15697e7ad0871f5c1a
Author:        Lokesh Vutla <lokeshvutla@ti.com>
AuthorDate:    Mon, 02 Nov 2020 17:36:31 +05:30
Committer:     Marc Zyngier <maz@kernel.org>
CommitterDate: Fri, 11 Dec 2020 14:47:50 

irqchip/ti-sci-intr: Fix freeing of irqs

ti_sci_intr_irq_domain_free() assumes that out_irq of intr is stored in
data->chip_data and uses it for calling ti_sci irq_free() and then
mark the out_irq as available resource. But ti_sci_intr_irq_domain_alloc()
is storing p_hwirq(parent's hardware irq) which is translated from out_irq.
This is causing resource leakage and eventually out_irq resources might
be exhausted. Fix ti_sci_intr_irq_domain_alloc() by storing the out_irq
in data->chip_data.

Fixes: a5b659bd4bc7 ("irqchip/ti-sci-intr: Add support for INTR being a parent to INTR")
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20201102120631.11165-1-lokeshvutla@ti.com
---
 drivers/irqchip/irq-ti-sci-intr.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/irqchip/irq-ti-sci-intr.c b/drivers/irqchip/irq-ti-sci-intr.c
index ac9d6d6..fe8fad2 100644
--- a/drivers/irqchip/irq-ti-sci-intr.c
+++ b/drivers/irqchip/irq-ti-sci-intr.c
@@ -129,7 +129,7 @@ static void ti_sci_intr_irq_domain_free(struct irq_domain *domain,
  * @virq:	Corresponding Linux virtual IRQ number
  * @hwirq:	Corresponding hwirq for the IRQ within this IRQ domain
  *
- * Returns parent irq if all went well else appropriate error pointer.
+ * Returns intr output irq if all went well else appropriate error pointer.
  */
 static int ti_sci_intr_alloc_parent_irq(struct irq_domain *domain,
 					unsigned int virq, u32 hwirq)
@@ -173,7 +173,7 @@ static int ti_sci_intr_alloc_parent_irq(struct irq_domain *domain,
 	if (err)
 		goto err_msg;
 
-	return p_hwirq;
+	return out_irq;
 
 err_msg:
 	irq_domain_free_irqs_parent(domain, virq, 1);
@@ -198,19 +198,19 @@ static int ti_sci_intr_irq_domain_alloc(struct irq_domain *domain,
 	struct irq_fwspec *fwspec = data;
 	unsigned long hwirq;
 	unsigned int flags;
-	int err, p_hwirq;
+	int err, out_irq;
 
 	err = ti_sci_intr_irq_domain_translate(domain, fwspec, &hwirq, &flags);
 	if (err)
 		return err;
 
-	p_hwirq = ti_sci_intr_alloc_parent_irq(domain, virq, hwirq);
-	if (p_hwirq < 0)
-		return p_hwirq;
+	out_irq = ti_sci_intr_alloc_parent_irq(domain, virq, hwirq);
+	if (out_irq < 0)
+		return out_irq;
 
 	irq_domain_set_hwirq_and_chip(domain, virq, hwirq,
 				      &ti_sci_intr_irq_chip,
-				      (void *)(uintptr_t)p_hwirq);
+				      (void *)(uintptr_t)out_irq);
 
 	return 0;
 }

Re: [PATCH] irqchip/ti-sci-intr: Fix freeing of irqs

[Marc Zyngier]

On Mon, 2 Nov 2020 17:36:31 +0530, Lokesh Vutla wrote:
> ti_sci_intr_irq_domain_free() assumes that out_irq of intr is stored in
> data->chip_data and uses it for calling ti_sci irq_free() and then
> mark the out_irq as available resource. But ti_sci_intr_irq_domain_alloc()
> is storing p_hwirq(parent's hardware irq) which is translated from out_irq.
> This is causing resource leakage and eventually out_irq resources might
> be exhausted. Fix ti_sci_intr_irq_domain_alloc() by storing the out_irq
> in data->chip_data.

Applied to irq/irqchip-next, thanks!

[1/1] irqchip/ti-sci-intr: Fix freeing of irqs
      commit: fc6c7cd3878641fd43189f15697e7ad0871f5c1a

Cheers,

	M.
-- 
Without deviation from the norm, progress is not possible.