linux-kernel - Re: [PATCH v6 7/8] PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYoC8_YxGX5fZmr7@lizhi-Precision-Tower-5810>
Date: Mon, 9 Feb 2026 10:53:23 -0500
From: Frank Li <Frank.li@....com>
To: Koichiro Den <den@...inux.co.jp>
Cc: vkoul@...nel.org, mani@...nel.org, cassel@...nel.org,
	jingoohan1@...il.com, lpieralisi@...nel.org, kwilczynski@...nel.org,
	robh@...nel.org, bhelgaas@...gle.com, kishon@...nel.org,
	jdmason@...zu.us, allenbh@...il.com, dmaengine@...r.kernel.org,
	linux-pci@...r.kernel.org, ntb@...ts.linux.dev,
	linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v6 7/8] PCI: endpoint: pci-ep-msi: Fix error unwind and
 prevent double alloc

On Mon, Feb 09, 2026 at 09:53:15PM +0900, Koichiro Den wrote:
> pci_epf_alloc_doorbell() stores the allocated doorbell message array in
> epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation
> fails, the array is freed but the EPF state may still point to freed
> memory.
>
> Clear epf->db_msg and epf->num_db on the MSI allocation failure path so
> that later cleanup cannot double-free the array and callers can retry
> allocation.
>
> Also return -EBUSY when doorbells have already been allocated to prevent
> leaking or overwriting an existing allocation.
>
> Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller")
> Signed-off-by: Koichiro Den <den@...inux.co.jp>
> ---

Thanks, fix patch should be first.

Reviewed-by: Frank Li <Frank.Li@....com>

Frank

>  drivers/pci/endpoint/pci-ep-msi.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c
> index 1b58357b905f..ad8a81d6ad77 100644
> --- a/drivers/pci/endpoint/pci-ep-msi.c
> +++ b/drivers/pci/endpoint/pci-ep-msi.c
> @@ -50,6 +50,9 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
>  		return -EINVAL;
>  	}
>
> +	if (epf->db_msg)
> +		return -EBUSY;
> +
>  	domain = of_msi_map_get_device_domain(epc->dev.parent, 0,
>  					      DOMAIN_BUS_PLATFORM_MSI);
>  	if (!domain) {
> @@ -79,6 +82,8 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
>  	if (ret) {
>  		dev_err(dev, "Failed to allocate MSI\n");
>  		kfree(msg);
> +		epf->db_msg = NULL;
> +		epf->num_db = 0;
>  		return ret;
>  	}
>
> --
> 2.51.0
>