[PATCH] irqchip/mst-intc: reject ranges beyond saved state capacity

[Radu Rendec]

On Wed, 2026-07-22 at 12:14 +0800, Pengpeng Hou wrote:
> The inclusive Device Tree IRQ range determines nr_irqs. Suspend and
> resume then use nr_irqs to walk the fixed saved_status array, which has
> MST_INTC_MAX_IRQS entries. A descending range underflows the unsigned
> subtraction, while a range wider than 64 entries exceeds that array.
> 
> Reject both forms before deriving nr_irqs.
> 
> Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>
> ---
>  drivers/irqchip/irq-mst-intc.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/irqchip/irq-mst-intc.c b/drivers/irqchip/irq-mst-intc.c
> index b5335f6fd6d6..1475335d668d 100644
> --- a/drivers/irqchip/irq-mst-intc.c
> +++ b/drivers/irqchip/irq-mst-intc.c
> @@ -263,6 +263,10 @@ static int __init mst_intc_of_init(struct device_node *dn,
>  	    of_property_read_u32_index(dn, "mstar,irqs-map-range", 1, &irq_end))
>  		return -EINVAL;
>  
> +	if (irq_end < irq_start ||
> +	    irq_end - irq_start >= MST_INTC_MAX_IRQS)
> +		return -EINVAL;
> +
>  	cd = kzalloc_obj(*cd);
>  	if (!cd)
>  		return -ENOMEM;

Reviewed-by: Radu Rendec <radu at rendec.net>