linux-kernel - [PATCH v2 2/3] PCI: dwc: Correct iATU index increment for MSG TLP region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251229-ecam_io_fix-v2-2-41a0e56a6faa@oss.qualcomm.com>
Date: Mon, 29 Dec 2025 16:12:42 +0530
From: Krishna Chaitanya Chundru <krishna.chundru@....qualcomm.com>
To: Jingoo Han <jingoohan1@...il.com>, Manivannan Sadhasivam <mani@...nel.org>,
        Lorenzo Pieralisi <lpieralisi@...nel.org>,
        Krzysztof Wilczyński <kwilczynski@...nel.org>,
        Rob Herring <robh@...nel.org>, Bjorn Helgaas <bhelgaas@...gle.com>,
        Frank Li <Frank.Li@....com>,
        Serge Semin <Sergey.Semin@...kalelectronics.ru>
Cc: linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org, macro@...am.me.uk,
        Krishna Chaitanya Chundru <krishna.chundru@....qualcomm.com>,
        stable@...r.kernel.org
Subject: [PATCH v2 2/3] PCI: dwc: Correct iATU index increment for MSG TLP
 region

Commit e1a4ec1a9520 ("PCI: dwc: Add generic MSG TLP support for sending
PME_Turn_Off when system suspend") introduced a mechanism to reserve an
iATU window for MSG TLP transactions. However, the code incorrectly
assigned pp->msg_atu_index = i without incrementing i first, causing
the MSG TLP region to reuse the last configured outbound window instead
of the next available one. This can cause issue with IO transfers as
this can over write iATU configured for IO memory.

Fix this by incrementing i before assigning it to msg_atu_index so
that the MSG TLP region uses a dedicated iATU entry.

Added error logs in dw_pcie_pme_turn_off().

Fixes: e1a4ec1a9520 ("PCI: dwc: Add generic MSG TLP support for sending PME_Turn_Off when system suspend")
Tested-by: Maciej W. Rozycki <macro@...am.me.uk>
Reviewed-by: Frank Li <Frank.Li@....com>
Cc: stable@...r.kernel.org
Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@....qualcomm.com>
---
 drivers/pci/controller/dwc/pcie-designware-host.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index 32a26458ed8f1696fe2fdcf9df6b795c4c761f1f..88b6ace0607e97bf6dd6bf7886baaa13bf267e6e 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -942,7 +942,7 @@ static int dw_pcie_iatu_setup(struct dw_pcie_rp *pp)
 		dev_warn(pci->dev, "Ranges exceed outbound iATU size (%d)\n",
 			 pci->num_ob_windows);
 
-	pp->msg_atu_index = i;
+	pp->msg_atu_index = ++i;
 
 	i = 0;
 	resource_list_for_each_entry(entry, &pp->bridge->dma_ranges) {
@@ -1113,11 +1113,15 @@ static int dw_pcie_pme_turn_off(struct dw_pcie *pci)
 	void __iomem *mem;
 	int ret;
 
-	if (pci->num_ob_windows <= pci->pp.msg_atu_index)
+	if (pci->num_ob_windows <= pci->pp.msg_atu_index) {
+		dev_err(pci->dev, "No available iATU enteries\n");
 		return -ENOSPC;
+	}
 
-	if (!pci->pp.msg_res)
+	if (!pci->pp.msg_res) {
+		dev_err(pci->dev, "Msg resource is not allocated\n");
 		return -ENOSPC;
+	}
 
 	atu.code = PCIE_MSG_CODE_PME_TURN_OFF;
 	atu.routing = PCIE_MSG_TYPE_R_BC;

-- 
2.34.1