linux-kernel - [tip: irq/urgent] genirq/msi: Fix off-by-one error in msi_domain

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <173002222286.1442.9459023448412471573.tip-bot2@tip-bot2>
Date: Sun, 27 Oct 2024 09:43:42 -0000
From: "tip-bot2 for Jinjie Ruan" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Jinjie Ruan <ruanjinjie@...wei.com>, Thomas Gleixner <tglx@...utronix.de>,
 x86@...nel.org, linux-kernel@...r.kernel.org, maz@...nel.org
Subject:
 [tip: irq/urgent] genirq/msi: Fix off-by-one error in msi_domain_alloc()

The following commit has been merged into the irq/urgent branch of tip:

Commit-ID:     5f994f534120f47432092fb36f5cb0c7a80ed2bf
Gitweb:        https://git.kernel.org/tip/5f994f534120f47432092fb36f5cb0c7a80ed2bf
Author:        Jinjie Ruan <ruanjinjie@...wei.com>
AuthorDate:    Sat, 26 Oct 2024 14:36:39 +08:00
Committer:     Thomas Gleixner <tglx@...utronix.de>
CommitterDate: Sun, 27 Oct 2024 10:40:47 +01:00

genirq/msi: Fix off-by-one error in msi_domain_alloc()

The error path in msi_domain_alloc(), frees the already allocated MSI
interrupts in a loop, but the loop condition terminates when the index
reaches zero, which fails to free the first allocated MSI interrupt at
index zero.

Check for >= 0 so that msi[0] is freed as well.

Fixes: f3cf8bb0d6c3 ("genirq: Add generic msi irq domain support")
Signed-off-by: Jinjie Ruan <ruanjinjie@...wei.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Link: https://lore.kernel.org/all/20241026063639.10711-1-ruanjinjie@huawei.com

---
 kernel/irq/msi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index 3a24d6b..396a067 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -718,7 +718,7 @@ static int msi_domain_alloc(struct irq_domain *domain, unsigned int virq,
 		ret = ops->msi_init(domain, info, virq + i, hwirq + i, arg);
 		if (ret < 0) {
 			if (ops->msi_free) {
-				for (i--; i > 0; i--)
+				for (i--; i >= 0; i--)
 					ops->msi_free(domain, info, virq + i);
 			}
 			irq_domain_free_irqs_top(domain, virq, nr_irqs);