Re: [PATCH v11 08/16] genirq/msi: Provide msi_device_domain_restore_msi_msgs()

[Thomas Gleixner <tglx@kernel.org>]

On Tue, Sep 29 2026 at 03:45, Pranjal Shrivastava wrote:
> +void msi_device_domain_restore_msi_msgs(struct device *dev, unsigned int domid)
> +{
> +	if (!dev->msi.data)
> +		return;
> +
> +	guard(msi_descs_lock)(dev);
> +	struct irq_domain *domain = msi_get_device_domain(dev, domid);
> +
> +	if (!domain || !irq_domain_is_msi_device(domain))
> +		return;
> +
> +	struct xarray *xa = &dev->msi.data->__domains[domid].store;
> +	struct msi_domain_info *info = domain->host_data;
> +	struct msi_desc *msi_desc;
> +	unsigned long idx;
> +
> +	xa_for_each_range(xa, idx, msi_desc, 0, info->hwsize - 1) {
> +		/* Only handle MSI entries which have an interrupt associated */
> +		if (!msi_desc_match(msi_desc, MSI_DESC_ASSOCIATED))
> +			continue;
> +
> +		scoped_irqdesc_get_and_buslock(msi_desc->irq, 0) {
> +			struct irq_data *data = irq_desc_get_irq_data(scoped_irqdesc);
> +			struct msi_msg msg = msi_desc->msg;
> +
> +			if (data->chip)
> +				irq_chip_write_msi_msg(data, &msg);
> +		}
> +	}

In this case sashiko is wrong:

> [Severity: Critical]
> Will this result in a NULL pointer dereference in hierarchical IRQ domains?
> 
> Since irq_desc_get_irq_data() retrieves the top-level irq_data, data->chip
> points to the top-level irq_chip. In hierarchical IRQ domains, the top-level
> irq_chip typically does not implement the irq_write_msi_msg callback.
> 
> When this top-level irq_data is passed to irq_chip_write_msi_msg(), it will
> dereference a NULL function pointer:

All MSI top level (device) domains implement the irq_write_msi_msg()
callback. That's the whole point of the top level MSI domain as that's
the one which has access to the device and the associated message store.

Thanks,

        tglx