[PATCH v2 1/3] irqchip/gic-v3-its: Don't free a vPE table shared with another ITS
From: Fuad Tabba <fuad.tabba@linux.dev>
Date: 2026-09-25 08:50:32
Also in:
lkml
Subsystem:
arm generic interrupt controller drivers, irqchip drivers, the rest · Maintainers:
Marc Zyngier, Thomas Gleixner, Linus Torvalds
On GICv4.1, its_alloc_tables() copies a sibling's vPE table baser
rather than allocating one, but its_free_tables() frees it like the
rest. A probe failure on the copying ITS then frees pages the enabled
sibling still points GITS_BASER2 at, and the kernel comes up running
on that sibling.
Mark a shared table so its_free_tables() skips it.
Fixes: 5e5168461c22c ("irqchip/gic-v4.1: VPE table (aka GICR_VPROPBASER) allocation")
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
drivers/irqchip/irq-gic-v3-its.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index e9807af235373..58e52095e6ea8 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c@@ -87,6 +87,8 @@ struct its_baser { u64 val; u32 order; u32 psz; + /* Inherited from a sibling ITS, not freed here */ + bool shared; }; struct its_device;
@@ -2604,7 +2606,8 @@ static void its_free_tables(struct its_node *its) for (i = 0; i < GITS_BASER_NR_REGS; i++) { if (its->tables[i].base) { - its_free_pages(its->tables[i].base, its->tables[i].order); + if (!its->tables[i].shared) + its_free_pages(its->tables[i].base, its->tables[i].order); its->tables[i].base = NULL; } }
@@ -2703,6 +2706,7 @@ static int its_alloc_tables(struct its_node *its) WARN_ON(i != 2); if ((sibling = find_sibling_its(its))) { *baser = sibling->tables[2]; + baser->shared = true; its_write_baser(its, baser, baser->val); continue; }
--
2.39.5