[PATCH] irqchip/gic-v3-its: Don't WARN on LPI free allocation failure

[Karl Mehltretter]

free_lpi_range() cannot give LPIs back to the allocator without
allocating a struct lpi_range to describe the freed range, so it
returns -ENOMEM (its only failure mode) when that allocation fails,
and its_lpi_free() turns this into a WARN_ON().

syzbot triggers the WARN_ON() by injecting a slab allocation failure
on device teardown, which with panic_on_warn becomes a panic:

WARNING: drivers/irqchip/irq-gic-v3-its.c:2251 at its_msi_teardown+0x3a4/0x424
its_msi_teardown+0x3a4/0x424
msi_remove_device_irq_domain+0x16c/0x27c
msi_device_data_release+0x38/0x9c

The failure is transient and the consequence benign: the freed range
is simply never returned to the allocator. This does not warrant a
WARN_ON() backtrace, so log a rate-limited error instead.

Fixes: 880cb3cddd16 ("irqchip/gic-v3-its: Refactor LPI allocator")
Reported-by: syzbot+229d76...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=229d761b8a110e6de517
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehlt...@gmail.com>
---
drivers/irqchip/irq-gic-v3-its.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 6f5811aae59c1..5ab278affa9dd 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2248,7 +2248,8 @@ static unsigned long *its_lpi_alloc(int nr_irqs, u32 *base, int *nr_ids)

static void its_lpi_free(unsigned long *bitmap, u32 base, u32 nr_ids)
{
- WARN_ON(free_lpi_range(base, nr_ids));
+ if (free_lpi_range(base, nr_ids))
+ pr_err_ratelimited("ITS: failed to free LPI range %u:%u\n", base, nr_ids);
bitmap_free(bitmap);
}

--
2.53.0