[PATCH] genirq/core: Propagate IRQ descriptor range search errors

[Avi Weiss]

irq_find_free_area() returns -ENOSPC when no suitable IRQ range is
available. __irq_alloc_descs() uses the negative result without
checking for errors. The unsigned count can cause start + cnt to
wrap, allowing descriptor allocation with an invalid IRQ number.

Return the search error before using the result in range arithmetic.

Fixes: 721255b9826b ("genirq: Use a maple tree for interrupt descriptor management")
Signed-off-by: Avi Weiss <thnkslprpt@xxxxxxxxx>
---
 kernel/irq/irqdesc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 7cbcc3fb9e6d..651f34dae034 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -922,6 +922,8 @@ int __ref __irq_alloc_descs(int irq, unsigned int from, unsigned int cnt, int no
 	start = irq_find_free_area(from, cnt);
 	if (irq >=0 && start != irq)
 		return -EEXIST;
+	if (start < 0)
+		return start;
 
 	if (start + cnt > total_nr_irqs) {
 		if (!irq_expand_nr_irqs(start + cnt))

base-commit: e9954f3fbddd25e1a01b7e5a0b72fb8b564204e0
-- 
2.53.0