Re: [PATCH 04/11] PCI: dwc: Add a host op to run before iMSI-RX status is read

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] PCI: dwc: NULL pointer dereference in dw_chained_msi_isr()
--

commit 3a93530b14d46331da98ba1bc4fa4fde8fc72e4b
Author: Koichiro Den <den@valinux.co.jp>

PCI: dwc: Add a host op to run before iMSI-RX status is read

This commit adds a pre_msi_irq host callback invoked from the generic chained
handler before the MSI status is read. Returning true skips the MSI handling,
which prevents stalls when DBI accesses are issued right after an unexpected
link down.

> diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
> index f5a38e6fd8d79..ad013dd0a1662 100644
> --- a/drivers/pci/controller/dwc/pcie-designware-host.c
> +++ b/drivers/pci/controller/dwc/pcie-designware-host.c
> @@ -95,7 +95,8 @@ static void dw_chained_msi_isr(struct irq_desc *desc)
>  	chained_irq_enter(chip, desc);
>  
>  	pp = irq_desc_get_handler_data(desc);
> -	dw_handle_msi_irq(pp);
> +	if (!pp->ops->pre_msi_irq || !pp->ops->pre_msi_irq(pp))

[Severity: High]
Does this introduce a NULL pointer dereference when pp->ops is NULL?

Some glue drivers (like qcom_pcie_ecam_host_init) explicitly bypass
dw_pcie_host_init() and do not provide a pp->ops structure. On these platforms,
pp->ops is left NULL since the structure is zero-initialized via devm_kzalloc().

When the chained MSI interrupt handler fires during normal system operation,
evaluating pp->ops->pre_msi_irq would unconditionally dereference the NULL
pointer and crash the kernel. 

Would it be possible to add a safety check for pp->ops before checking for
the pre_msi_irq callback?

> +		dw_handle_msi_irq(pp);
>  
>  	chained_irq_exit(chip, desc);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260918032038.2216471-1-den@valinux.co.jp?part=4