[PATCH 3/3] irqchip/gic-v5: Fix error handling in gicv5_its_irq_domain_alloc()

[Lorenzo Pieralisi]

On Wed, Jul 16, 2025 at 02:38:22PM -0500, Dan Carpenter wrote:
> There are two issues to fix in this code:
> 1) If gicv5_alloc_lpi() fails the original code was checking the wrong
> variable.  Fix the mixup between "ret" and "lpi".
> 2) If irq_domain_alloc_irqs_parent() fails, then clean up all the loop
> iterations instead of just the current iteration.
> 
> Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
> Signed-off-by: Dan Carpenter <dan.carpenter at linaro.org>
> ---
>  drivers/irqchip/irq-gic-v5-its.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
> index 55360ae9f1f6..8cc8563e27d5 100644
> --- a/drivers/irqchip/irq-gic-v5-its.c
> +++ b/drivers/irqchip/irq-gic-v5-its.c
> @@ -949,15 +949,18 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi
>  	device_id = its_dev->device_id;
>  
>  	for (i = 0; i < nr_irqs; i++) {
> -		lpi = gicv5_alloc_lpi();
> +		ret = gicv5_alloc_lpi();
>  		if (ret < 0) {
>  			pr_debug("Failed to find free LPI!\n");
>  			goto out_eventid;

This should be:

goto out_free_lpi;

otherwise we miss cleaning up for [0, i - 1] on LPI alloc failure.

I can fix it up - not sure it is worth splitting it into two patches,
just let me know please how you want me to handle it.

Thanks,
Lorenzo

>  		}
> +		lpi = ret;
>  
>  		ret = irq_domain_alloc_irqs_parent(domain, virq + i, 1, &lpi);
> -		if (ret)
> +		if (ret) {
> +			gicv5_free_lpi(lpi);
>  			goto out_free_lpi;
> +		}
>  
>  		/*
>  		 * Store eventid and deviceid into the hwirq for later use.
> @@ -979,7 +982,12 @@ static int gicv5_its_irq_domain_alloc(struct irq_domain *domain, unsigned int vi
>  	return 0;
>  
>  out_free_lpi:
> -	gicv5_free_lpi(lpi);
> +	while (--i >= 0) {
> +		irqd = irq_domain_get_irq_data(domain, virq + i);
> +		gicv5_free_lpi(irqd->parent_data->hwirq);
> +		irq_domain_reset_irq_data(irqd);
> +		irq_domain_free_irqs_parent(domain, virq + i, 1);
> +	}
>  out_eventid:
>  	gicv5_its_free_eventid(its_dev, event_id_base, nr_irqs);
>  	return ret;
> -- 
> 2.47.2
>