Re: [PATCH v11 07/16] genirq/msi: Cache MSI message in irq_chip_write_msi_msg()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] irq: NULL pointer dereference in irq_chip_write_msi_msg()
--

commit 98ab4cb46e40acf3e5ccb95b4213b5490ae2ff8a
Author: Pranjal Shrivastava <praan@google.com>

genirq/msi: Cache MSI message in irq_chip_write_msi_msg()

Currently, PCI MSI caches the composed MSI message into the MSI descriptor
inside __pci_write_msi_msg(). This patch caches the message directly in
irq_chip_write_msi_msg() so that all hierarchical MSI domains automatically
record the latest message.

> diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
> index fb5f372215bf2..df460a574d800 100644
> --- a/kernel/irq/msi.c
> +++ b/kernel/irq/msi.c
> @@ -634,6 +634,15 @@ static unsigned int msi_domain_get_hwsize(struct device *dev, unsigned int domid
>  static inline void irq_chip_write_msi_msg(struct irq_data *data,
>  					  struct msi_msg *msg)
>  {
> +	struct msi_desc *desc = irq_data_get_msi_desc(data);
> +
> +	/*
> +	 * PCI Multi-MSI shares a single descriptor across all vectors and
> +	 * the device stores only the base message. Cache the message of the
> +	 * first interrupt only, so that sub-vectors cannot overwrite it.
> +	 */
> +	if (desc->irq == data->irq)

[Severity: Critical]
Does this code cause a NULL pointer dereference for domains without an
msi_desc object?

Looking at irq_chip_write_msi_msg() in kernel/irq/msi.c,
architecture-specific domains like the x86 HPET (hpet_msi_domain_info) and
DMAR (dmar_msi_domain_info) utilize generic MSI domain operations but do not
allocate an msi_desc object for their interrupts.

When an interrupt from these domains is activated or its affinity is updated,
calls like msi_domain_activate() or msi_domain_set_affinity() invoke
irq_chip_write_msi_msg().

Because irq_data_get_msi_desc(data) returns NULL for these interrupts,
checking desc->irq unconditionally could lead to a fatal dereference during
boot.

I checked the follow-up patches in the series and it appears a check for
desc is not introduced in any subsequent patch, so this regression remains
present in the final series state.

Should this be updated to check if desc is valid first?

> +		desc->msg = *msg;
>  	data->chip->irq_write_msi_msg(data, msg);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929034510.2023173-1-praan@google.com?part=7