Patch "PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     pci-xilinx-nwl-fix-off-by-one-in-intx-irq-handler.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f413b3f49a7d9ceb3ec867837f0d031c86179bd9
Author: Sean Anderson <sean.anderson@xxxxxxxxx>
Date:   Fri May 31 12:13:32 2024 -0400

    PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
    
    [ Upstream commit 0199d2f2bd8cd97b310f7ed82a067247d7456029 ]
    
    MSGF_LEG_MASK is laid out with INTA in bit 0, INTB in bit 1, INTC in bit 2,
    and INTD in bit 3. Hardware IRQ numbers start at 0, and we register
    PCI_NUM_INTX IRQs. So to enable INTA (aka hwirq 0) we should set bit 0.
    Remove the subtraction of one.
    
    This bug would cause INTx interrupts not to be delivered, as enabling INTB
    would actually enable INTA, and enabling INTA wouldn't enable anything at
    all. It is likely that this got overlooked for so long since most PCIe
    hardware uses MSIs. This fixes the following UBSAN error:
    
      UBSAN: shift-out-of-bounds in ../drivers/pci/controller/pcie-xilinx-nwl.c:389:11
      shift exponent 18446744073709551615 is too large for 32-bit type 'int'
      CPU: 1 PID: 61 Comm: kworker/u10:1 Not tainted 6.6.20+ #268
      Hardware name: xlnx,zynqmp (DT)
      Workqueue: events_unbound deferred_probe_work_func
      Call trace:
      dump_backtrace (arch/arm64/kernel/stacktrace.c:235)
      show_stack (arch/arm64/kernel/stacktrace.c:242)
      dump_stack_lvl (lib/dump_stack.c:107)
      dump_stack (lib/dump_stack.c:114)
      __ubsan_handle_shift_out_of_bounds (lib/ubsan.c:218 lib/ubsan.c:387)
      nwl_unmask_leg_irq (drivers/pci/controller/pcie-xilinx-nwl.c:389 (discriminator 1))
      irq_enable (kernel/irq/internals.h:234 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345)
      __irq_startup (kernel/irq/internals.h:239 kernel/irq/chip.c:180 kernel/irq/chip.c:250)
      irq_startup (kernel/irq/chip.c:270)
      __setup_irq (kernel/irq/manage.c:1800)
      request_threaded_irq (kernel/irq/manage.c:2206)
      pcie_pme_probe (include/linux/interrupt.h:168 drivers/pci/pcie/pme.c:348)
    
    Fixes: 9a181e1093af ("PCI: xilinx-nwl: Modify IRQ chip for legacy interrupts")
    Link: https://lore.kernel.org/r/20240531161337.864994-3-sean.anderson@xxxxxxxxx
    Signed-off-by: Sean Anderson <sean.anderson@xxxxxxxxx>
    Signed-off-by: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
    Cc: stable@xxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c
index c710f9c298786..bad420036aefc 100644
--- a/drivers/pci/controller/pcie-xilinx-nwl.c
+++ b/drivers/pci/controller/pcie-xilinx-nwl.c
@@ -386,7 +386,7 @@ static void nwl_mask_leg_irq(struct irq_data *data)
 	u32 mask;
 	u32 val;
 
-	mask = 1 << (data->hwirq - 1);
+	mask = 1 << data->hwirq;
 	raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags);
 	val = nwl_bridge_readl(pcie, MSGF_LEG_MASK);
 	nwl_bridge_writel(pcie, (val & (~mask)), MSGF_LEG_MASK);
@@ -400,7 +400,7 @@ static void nwl_unmask_leg_irq(struct irq_data *data)
 	u32 mask;
 	u32 val;
 
-	mask = 1 << (data->hwirq - 1);
+	mask = 1 << data->hwirq;
 	raw_spin_lock_irqsave(&pcie->leg_mask_lock, flags);
 	val = nwl_bridge_readl(pcie, MSGF_LEG_MASK);
 	nwl_bridge_writel(pcie, (val | mask), MSGF_LEG_MASK);