If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access. The code checks for invalid values, but doesn't set the error code. Return -EINVAL in that case, instead of returning success.
Unified · Split
| @@ -170,7 +170,7 @@ static int mchp_eic_domain_alloc(struct irq_domain *domain, unsigned int virq, · 169 unmodified lines | |||
| 170 | 170 | ||
| 171 | ret = irq_domain_translate_twocell(domain, fwspec, &hwirq, &type); | 171 | ret = irq_domain_translate_twocell(domain, fwspec, &hwirq, &type); |
| 172 | if (ret || hwirq >= MCHP_EIC_NIRQ) | 172 | if (ret || hwirq >= MCHP_EIC_NIRQ) |
| 173 | return ret; | 173 | return ret ?: -EINVAL; |
| 174 | 174 | ||
| 175 | switch (type) { | 175 | switch (type) { |
| 176 | case IRQ_TYPE_EDGE_RISING: | 176 | case IRQ_TYPE_EDGE_RISING: |