From patchwork Fri May 31 16:13:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sean Anderson X-Patchwork-Id: 13681875 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 296C2C25B75 for ; Fri, 31 May 2024 16:14:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=3dJHYJqq6O43qXW8a0Sspw2bAlzfWTVDyfXBY08bGhE=; b=aY6p8XkaSLCRAL z39ywm4zTqY8saSh4zFQl1LD7pfEcP6CK98nGRReQpmHwVsbmRvCMCwbgY/3vM9dujKq8wv3q2S2t XuEG/zhjyjt9IZEH/zH/wnZiR/3MhdW+943v8rGEtLjknvo/Dd39S6YxziMsO0xLQF8PkESWBibRN AYGKO+s2LT8jjBAfL9UCAK71PhfUA/RXFbQDLl/3YtlqFoKIF30D2W5ge7yFZ6re68K4a2BTRu3bT X2TiwJ6dHhj/ofAld0FrJ85UGWe+NCDJW5T+eOHqro5dF1GPz2L2S0cXXz11zWjBvoKXDPf1w1GtZ 2Ck8z6tSlOU/uclxr2Iw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sD4tD-0000000Ampu-3NlA; Fri, 31 May 2024 16:13:59 +0000 Received: from out-189.mta0.migadu.com ([2001:41d0:1004:224b::bd]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sD4tA-0000000AmmV-1oVl for linux-arm-kernel@lists.infradead.org; Fri, 31 May 2024 16:13:58 +0000 X-Envelope-To: lpieralisi@kernel.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1717172032; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Qaf7wlJcbuaI5XLr7jlnJohIFPCzjuNsqqKvlQY7mnY=; b=w2FIGB0INIhu6VVvsFM5KwIGw4z7lIFwD8CKxzGHIC739QzQmk2STRcVji1Ca84PW+sl91 0zp2Uiw5YUmH0jFB5Hf4777v2LPsoFbDiYlQJbIEr0B+3F2pr+gOPfQ+usbw2psr2x9opw uMROgDK+ucm0Dla8+Dj4+FOVc5xZXvQ= X-Envelope-To: kw@linux.com X-Envelope-To: robh@kernel.org X-Envelope-To: linux-pci@vger.kernel.org X-Envelope-To: thippeswamy.havalige@amd.com X-Envelope-To: linux-arm-kernel@lists.infradead.org X-Envelope-To: markus.elfring@web.de X-Envelope-To: dan.carpenter@linaro.org X-Envelope-To: linux-kernel@vger.kernel.org X-Envelope-To: bhelgaas@google.com X-Envelope-To: michal.simek@amd.com X-Envelope-To: sean.anderson@linux.dev X-Envelope-To: stable@vger.kernel.org X-Envelope-To: bharatku@xilinx.com X-Envelope-To: helgaas@kernel.org X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Sean Anderson To: Lorenzo Pieralisi , =?utf-8?q?Krzysztof_Wilczy?= =?utf-8?q?=C5=84ski?= , Rob Herring , linux-pci@vger.kernel.org Cc: Thippeswamy Havalige , linux-arm-kernel@lists.infradead.org, Markus Elfring , Dan Carpenter , linux-kernel@vger.kernel.org, Bjorn Helgaas , Michal Simek , Sean Anderson , stable@vger.kernel.org, Bharat Kumar Gogada , Bjorn Helgaas Subject: [PATCH v4 2/7] PCI: xilinx-nwl: Fix off-by-one in IRQ handler Date: Fri, 31 May 2024 12:13:32 -0400 Message-Id: <20240531161337.864994-3-sean.anderson@linux.dev> In-Reply-To: <20240531161337.864994-1-sean.anderson@linux.dev> References: <20240531161337.864994-1-sean.anderson@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240531_091356_901025_3AE4C2BF X-CRM114-Status: GOOD ( 10.65 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org MSGF_LEG_MASK is laid out with INTA in bit 0, INTB in bit 1, INTC in bit 2, and INTD in bit 3. Hardware IRQ numbers start at 0, and we register PCI_NUM_INTX irqs. So to enable INTA (aka hwirq 0) we should set bit 0. Remove the subtraction of one. This bug would cause legacy interrupts not to be delivered, as enabling INTB would actually enable INTA, and enabling INTA wouldn't enable anything at all. It is likely that this got overlooked for so long since most PCIe hardware uses MSIs. This fixes the following UBSAN error: UBSAN: shift-out-of-bounds in ../drivers/pci/controller/pcie-xilinx-nwl.c:389:11 shift exponent 18446744073709551615 is too large for 32-bit type 'int' CPU: 1 PID: 61 Comm: kworker/u10:1 Not tainted 6.6.20+ #268 Hardware name: xlnx,zynqmp (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:235) show_stack (arch/arm64/kernel/stacktrace.c:242) dump_stack_lvl (lib/dump_stack.c:107) dump_stack (lib/dump_stack.c:114) __ubsan_handle_shift_out_of_bounds (lib/ubsan.c:218 lib/ubsan.c:387) nwl_unmask_leg_irq (drivers/pci/controller/pcie-xilinx-nwl.c:389 (discriminator 1)) irq_enable (kernel/irq/internals.h:234 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345) __irq_startup (kernel/irq/internals.h:239 kernel/irq/chip.c:180 kernel/irq/chip.c:250) irq_startup (kernel/irq/chip.c:270) __setup_irq (kernel/irq/manage.c:1800) request_threaded_irq (kernel/irq/manage.c:2206) pcie_pme_probe (include/linux/interrupt.h:168 drivers/pci/pcie/pme.c:348) Fixes: 9a181e1093af ("PCI: xilinx-nwl: Modify IRQ chip for legacy interrupts") Cc: Signed-off-by: Sean Anderson --- Changes in v4: - Explain likely effects of the off-by-one error - Trim down UBSAN backtrace Changes in v3: - Expand commit message drivers/pci/controller/pcie-xilinx-nwl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c index 0408f4d612b5..437927e3bcca 100644 --- a/drivers/pci/controller/pcie-xilinx-nwl.c +++ b/drivers/pci/controller/pcie-xilinx-nwl.c @@ -371,7 +371,7 @@ static void nwl_mask_intx_irq(struct irq_data *data) u32 mask; u32 val; - mask = 1 << (data->hwirq - 1); + mask = 1 << data->hwirq; raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags); val = nwl_bridge_readl(pcie, MSGF_LEG_MASK); nwl_bridge_writel(pcie, (val & (~mask)), MSGF_LEG_MASK); @@ -385,7 +385,7 @@ static void nwl_unmask_intx_irq(struct irq_data *data) u32 mask; u32 val; - mask = 1 << (data->hwirq - 1); + mask = 1 << data->hwirq; raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags); val = nwl_bridge_readl(pcie, MSGF_LEG_MASK); nwl_bridge_writel(pcie, (val | mask), MSGF_LEG_MASK);