From: Gyeyoung Baek gye976@gmail.com
[ Upstream commit 8a2277a3c9e4cc5398f80821afe7ecbe9bdf2819 ]
Initialize `ops` member's pointers properly by using kzalloc() instead of kmalloc() when allocating the simulation work context. Otherwise the pointers contain random content leading to invalid dereferencing.
Signed-off-by: Gyeyoung Baek gye976@gmail.com Signed-off-by: Thomas Gleixner tglx@linutronix.de Link: https://lore.kernel.org/all/20250612124827.63259-1-gye976@gmail.com Signed-off-by: Sasha Levin sashal@kernel.org ---
**YES**
This commit should be backported to stable kernel trees, specifically to the v6.11 stable series and any newer stable branches.
## Detailed Explanation:
### 1. **Critical Bug Fix** The commit fixes a serious uninitialized memory bug. The code change from `kmalloc()` to `kzalloc()` is critical because:
```c // Before (buggy): struct irq_sim_work_ctx *work_ctx __free(kfree) = kmalloc(sizeof(*work_ctx), GFP_KERNEL);
// After (fixed): struct irq_sim_work_ctx *work_ctx __free(kfree) = kzalloc(sizeof(*work_ctx), GFP_KERNEL); ```
### 2. **The Bug Impact** The `irq_sim_work_ctx` structure contains an `ops` member with function pointers: - `ops.irq_sim_irq_requested` - `ops.irq_sim_irq_released`
When `irq_domain_create_sim_full()` is called with `ops=NULL` (which happens when using the older `irq_domain_create_sim()` API), these pointers are left uninitialized with random memory content.
### 3. **Potential Consequences** The uninitialized pointers are checked in: - `irq_sim_request_resources()`: `if (work_ctx->ops.irq_sim_irq_requested)` - `irq_sim_release_resources()`: `if (work_ctx->ops.irq_sim_irq_released)`
If these random values are non-zero, the kernel will attempt to call garbage function pointers, leading to: - **Kernel crashes/panics** - **Security vulnerabilities** (jumping to arbitrary memory) - **Unpredictable behavior**
### 4. **Simple and Safe Fix** The fix is minimal (changing one function call) with no side effects: - `kzalloc()` guarantees all fields are zero-initialized - This ensures function pointers are NULL when not explicitly set - No performance impact (negligible difference for a one-time allocation)
### 5. **Affected Versions** Based on my repository analysis: - The bug was introduced in v6.11-rc1 (commit 011f583781fa) - Only kernels v6.11 and newer are affected - The fix should be backported to v6.11.y stable series
### 6. **Missing Fixes Tag** The commit should have included: ``` Fixes: 011f583781fa ("genirq/irq_sim: add an extended irq_sim initializer") ```
This is a textbook example of a commit that meets stable backport criteria: - Fixes a real bug that can cause crashes - Small, contained change - No new features or architectural changes - Clear bugfix with minimal regression risk
kernel/irq/irq_sim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/irq/irq_sim.c b/kernel/irq/irq_sim.c index 1a3d483548e2f..ae4c9cbd1b4b9 100644 --- a/kernel/irq/irq_sim.c +++ b/kernel/irq/irq_sim.c @@ -202,7 +202,7 @@ struct irq_domain *irq_domain_create_sim_full(struct fwnode_handle *fwnode, void *data) { struct irq_sim_work_ctx *work_ctx __free(kfree) = - kmalloc(sizeof(*work_ctx), GFP_KERNEL); + kzalloc(sizeof(*work_ctx), GFP_KERNEL);
if (!work_ctx) return ERR_PTR(-ENOMEM);