Re: [PATCH v11 08/16] genirq/msi: Provide msi_device_domain_restore_msi_msgs()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] irq/msi: NULL pointer dereference in msi_device_domain_restore_msi_msgs
--

commit 095b22d878464bc6c7b357c12fc988c69e1487d7
Author: Thomas Gleixner <tglx@kernel.org>

genirq/msi: Provide msi_device_domain_restore_msi_msgs()

This commit provides msi_device_domain_restore_msi_msgs() to iterate over MSI
descriptors and rewrite cached MSI messages for devices that lose register
state during power transitions. It iterates over the associated MSI descriptors
in the device's MSI domain and rewrites the messages via the irq_chip hierarchy.

> diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
> index df460a574d800..8fb855b5e09f3 100644
> --- a/kernel/irq/msi.c
> +++ b/kernel/irq/msi.c
[ ... ]
> +	xa_for_each_range(xa, idx, msi_desc, 0, info->hwsize - 1) {
> +		/* Only handle MSI entries which have an interrupt associated */
> +		if (!msi_desc_match(msi_desc, MSI_DESC_ASSOCIATED))
> +			continue;
> +
> +		scoped_irqdesc_get_and_buslock(msi_desc->irq, 0) {
> +			struct irq_data *data = irq_desc_get_irq_data(scoped_irqdesc);
> +			struct msi_msg msg = msi_desc->msg;
> +
> +			if (data->chip)
> +				irq_chip_write_msi_msg(data, &msg);

[Severity: Critical]
Will this result in a NULL pointer dereference in hierarchical IRQ domains?

Since irq_desc_get_irq_data() retrieves the top-level irq_data, data->chip
points to the top-level irq_chip. In hierarchical IRQ domains, the top-level
irq_chip typically does not implement the irq_write_msi_msg callback.

When this top-level irq_data is passed to irq_chip_write_msi_msg(), it will
dereference a NULL function pointer:

kernel/irq/msi.c:irq_chip_write_msi_msg() {
    ...
    data->chip->irq_write_msi_msg(data, msg);
}

Should this code retrieve the specific irq_data for the MSI domain that
actually implements the write_msi_msg callback, rather than using the
top-level irq_data?

> +		}
> +	}
> +}
> +EXPORT_SYMBOL_GPL(msi_device_domain_restore_msi_msgs);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929034510.2023173-1-praan@google.com?part=8