[PATCH 08/10] irqchip/gic-v5: Invalidate ITS device cache before freeing ITT

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:33:01PM +0000, Sascha Bischoff wrote:
> A cached device table entry can still reference the ITT after its
> memory is freed via kfree(), even if the DTE has been marked as
> invalid. Once the memory has been released, it could be reallocated,
> and it would be unfortunate for the hardware to interpret this as a
> valid ITT.
> 
> Invalidate the device cache and wait for completion before freeing the
> ITT during device teardown.
> 
> Fixes: 57d72196dfc85 ("irqchip/gic-v5: Add GICv5 ITS support")
> Signed-off-by: Sascha Bischoff <sascha.bischoff at arm.com>
> ---
>  drivers/irqchip/irq-gic-v5-its.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
> index 8628de326f28d..4de07bbdc4923 100644
> --- a/drivers/irqchip/irq-gic-v5-its.c
> +++ b/drivers/irqchip/irq-gic-v5-its.c
> @@ -556,6 +556,7 @@ static int gicv5_its_device_unregister(struct gicv5_its_chip_data *its,
>  				       struct gicv5_its_dev *its_dev)
>  {
>  	__le64 *dte;
> +	int ret;
>  
>  	dte = gicv5_its_devtab_get_dte_ref(its, its_dev->device_id, false);
>  
> @@ -568,9 +569,10 @@ static int gicv5_its_device_unregister(struct gicv5_its_chip_data *its,
>  	/* Zero everything - make it clear that this is an invalid entry */
>  	its_write_table_entry(its, dte, 0);
>  
> +	ret = gicv5_its_device_cache_inv(its, its_dev);
>  	gicv5_its_free_itt(its_dev);
>  
> -	return gicv5_its_device_cache_inv(its, its_dev);
> +	return ret;

Patch is right, though we don't check ret (gicv5_its_device_unregister()) so
rather that pretending to return anything useful I'd just drop it
(gicv5_wait_for_op_s() spits an error already on timeout, not sure more than
that there is anything we can do at this stage).

Again, this is a fix so I can clean this up later:

Acked-by: Lorenzo Pieralisi <lpieralisi at kernel.org>

>  }
>  
>  /*
> 
> -- 
> 2.34.1
>