[PATCH AUTOSEL 6.15 10/20] genirq/irq_sim: Initialize work context pointers properly

[Sasha Levin]

From: Gyeyoung Baek <gye976@xxxxxxxxx>

[ Upstream commit 8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819 ]

Initialize `ops` member's pointers properly by using kzalloc() instead of
kmalloc() when allocating the simulation work context. Otherwise the
pointers contain random content leading to invalid dereferencing.

Signed-off-by: Gyeyoung Baek <gye976@xxxxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Link: https://lore.kernel.org/all/20250612124827.63259-1-gye976@xxxxxxxxx
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---

**YES**

This commit should be backported to stable kernel trees, specifically to
the v6.11 stable series and any newer stable branches.

## Detailed Explanation:

### 1. **Critical Bug Fix**
The commit fixes a serious uninitialized memory bug. The code change
from `kmalloc()` to `kzalloc()` is critical because:

```c
// Before (buggy):
struct irq_sim_work_ctx *work_ctx __free(kfree) =
    kmalloc(sizeof(*work_ctx), GFP_KERNEL);

// After (fixed):
struct irq_sim_work_ctx *work_ctx __free(kfree) =
    kzalloc(sizeof(*work_ctx), GFP_KERNEL);
```

### 2. **The Bug Impact**
The `irq_sim_work_ctx` structure contains an `ops` member with function
pointers:
- `ops.irq_sim_irq_requested`
- `ops.irq_sim_irq_released`

When `irq_domain_create_sim_full()` is called with `ops=NULL` (which
happens when using the older `irq_domain_create_sim()` API), these
pointers are left uninitialized with random memory content.

### 3. **Potential Consequences**
The uninitialized pointers are checked in:
- `irq_sim_request_resources()`: `if
  (work_ctx->ops.irq_sim_irq_requested)`
- `irq_sim_release_resources()`: `if
  (work_ctx->ops.irq_sim_irq_released)`

If these random values are non-zero, the kernel will attempt to call
garbage function pointers, leading to:
- **Kernel crashes/panics**
- **Security vulnerabilities** (jumping to arbitrary memory)
- **Unpredictable behavior**

### 4. **Simple and Safe Fix**
The fix is minimal (changing one function call) with no side effects:
- `kzalloc()` guarantees all fields are zero-initialized
- This ensures function pointers are NULL when not explicitly set
- No performance impact (negligible difference for a one-time
  allocation)

### 5. **Affected Versions**
Based on my repository analysis:
- The bug was introduced in v6.11-rc1 (commit 011f583781fa)
- Only kernels v6.11 and newer are affected
- The fix should be backported to v6.11.y stable series

### 6. **Missing Fixes Tag**
The commit should have included:
```
Fixes: 011f583781fa ("genirq/irq_sim: add an extended irq_sim
initializer")
```

This is a textbook example of a commit that meets stable backport
criteria:
- Fixes a real bug that can cause crashes
- Small, contained change
- No new features or architectural changes
- Clear bugfix with minimal regression risk

 kernel/irq/irq_sim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/irq/irq_sim.c b/kernel/irq/irq_sim.c
index 1a3d483548e2f..ae4c9cbd1b4b9 100644
--- a/kernel/irq/irq_sim.c
+++ b/kernel/irq/irq_sim.c
@@ -202,7 +202,7 @@ struct irq_domain *irq_domain_create_sim_full(struct fwnode_handle *fwnode,
 					      void *data)
 {
 	struct irq_sim_work_ctx *work_ctx __free(kfree) =
-				kmalloc(sizeof(*work_ctx), GFP_KERNEL);
+				kzalloc(sizeof(*work_ctx), GFP_KERNEL);
 
 	if (!work_ctx)
 		return ERR_PTR(-ENOMEM);
-- 
2.39.5