Re: [PATCH v3 3/5] powerpc/xive: propagate IPI init errors to prevent use-after-free

When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),
the error path frees the global xive_ipis array.  However,
xive_smp_probe() previously ignored this failure and proceeded to
call xive_setup_cpu_ipi(), which dereferences the already-freed
xive_ipis pointer -- a use-after-free.

Now that xive_smp_probe() returns int (previous patch), propagate
the error from xive_init_ipis() and xive_setup_cpu_ipi() through
xive_smp_probe().  Check the return value in both pnv_smp_probe()
and pSeries_smp_probe() so that IPI setup is aborted cleanly on
failure, avoiding the use-after-free.

Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller")
Fixes: cbc06f051c52 ("powerpc/xive: Do not skip CPU-less nodes when creating the IPIs")
Signed-off-by: Gou Hao <redacted>
Reviewed-by: Wentao Guan <redacted>
Reviewed-by: jiazhenyuan <redacted>
---
  arch/powerpc/platforms/powernv/smp.c |  8 +++++---
  arch/powerpc/platforms/pseries/smp.c |  8 +++++---
  arch/powerpc/sysdev/xive/common.c    | 10 ++++++----
  3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
index 8f41ef364fc6..b1201dbafcaf 100644
--- a/arch/powerpc/platforms/powernv/smp.c
+++ b/arch/powerpc/platforms/powernv/smp.c

@@ -332,10 +332,12 @@ static void pnv_cause_ipi(int cpu)
  
  static void __init pnv_smp_probe(void)
  {
-	if (xive_enabled())
-		xive_smp_probe();
-	else
+	if (xive_enabled()) {
+		if (xive_smp_probe() < 0)
+			return;
+	} else {
  		xics_smp_probe();
+	}
  
  	if (cpu_has_feature(CPU_FTR_DBELL)) {
  		ic_cause_ipi = smp_ops->cause_ipi;

diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index db99725e752b..14cd0634eeca 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c

@@ -194,10 +194,12 @@ static int pseries_cause_nmi_ipi(int cpu)
  
  static __init void pSeries_smp_probe(void)
  {
-	if (xive_enabled())
-		xive_smp_probe();
-	else
+	if (xive_enabled()) {
+		if (xive_smp_probe() < 0)
+			return;
+	} else {
  		xics_smp_probe();
+	}
  
  	/* No doorbell facility, must use the interrupt controller for IPIs */
  	if (!cpu_has_feature(CPU_FTR_DBELL))

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index 9f80c16be23f..bbe7c85274ea 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c

@@ -1267,15 +1267,17 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc)
  
  int __init xive_smp_probe(void)
  {
+	int ret;
+
  	smp_ops->cause_ipi = xive_cause_ipi;
  
  	/* Register the IPI */
-	xive_init_ipis();
+	ret = xive_init_ipis();
+	if (ret < 0)
+		return ret;
  
  	/* Allocate and setup IPI for the boot CPU */
-	xive_setup_cpu_ipi(smp_processor_id());
-
-	return 0;
+	return xive_setup_cpu_ipi(smp_processor_id());
  }
  
  #endif /* CONFIG_SMP */