If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access. The code checks for invalid values, but doesn't set the error code. Return -EINVAL in that case, instead of returning success.
Unified · Split
| @@ -170,7 +170,7 @@ static int mchp_eic_domain_alloc(struct irq_domain *domain, unsigned int virq, · 169 unmodified lines | ||
| 170 | 170 | |
| 171 | 171 | ret = irq_domain_translate_twocell(domain, fwspec, &hwirq, &type); |
| 172 | 172 | if (ret || hwirq >= MCHP_EIC_NIRQ) |
| 173 | − return ret; | |
| 173 | + return ret ?: -EINVAL; | |
| 174 | 174 | |
| 175 | 175 | switch (type) { |
| 176 | 176 | case IRQ_TYPE_EDGE_RISING: |