[PATCH] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[PATCH] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

msix_setup_msi_descs() reuses a single stack descriptor for all
MSI-X entries.

Since msix_prepare_msi_desc() only sets can_mask for non-virtual
descriptors, a virtual descriptor can inherit can_mask == 1 from
the preceding real descriptor.

As msi_domain_insert_msi_desc() copies the descriptor, this stale
value can cause pci_msix_write_vector_ctrl() to access beyond the
mapped MSI-X table.

Clear the descriptor inside the loop to ensure each MSI-X entry
starts with can_mask == 0.

Fixes: 3ece3e8e5976 ("PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/pci/msi/msi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
index a346284..681dd2f 100644
--- a/drivers/pci/msi/msi.c
+++ b/drivers/pci/msi/msi.c
@@ -638,9 +638,8 @@ static int msix_setup_msi_descs(struct pci_dev *dev, struct msix_entry *entries,
 	struct irq_affinity_desc *curmsk;
 	struct msi_desc desc;
 
-	memset(&desc, 0, sizeof(desc));
-
 	for (i = 0, curmsk = masks; i < nvec; i++, curmsk++) {
+		memset(&desc, 0, sizeof(desc));
 		desc.msi_index = entries ? entries[i].entry : i;
 		desc.affinity = masks ? curmsk : NULL;
 		desc.pci.msi_attrib.is_virtual = desc.msi_index >= vec_count;
-- 
2.9.4

Re: [PATCH] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[sashiko-bot]

> From: Li RongQing <lirongqing@baidu.com>
> 
> msix_setup_msi_descs() reuses a single stack descriptor for all
> MSI-X entries.
> 
> Since msix_prepare_msi_desc() only sets can_mask for non-virtual
> descriptors, a virtual descriptor can inherit can_mask == 1 from
> the preceding real descriptor.
> 
> As msi_domain_insert_msi_desc() copies the descriptor, this stale
> value can cause pci_msix_write_vector_ctrl() to access beyond the
> mapped MSI-X table.
> 
> Clear the descriptor inside the loop to ensure each MSI-X entry
> starts with can_mask == 0.
> 
> Fixes: 3ece3e8e5976 ("PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109031411.2205-1-lirongqing@baidu.com?part=1

Re: [PATCH] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[Farhan Ali]

Hi Li,

On 11/8/2026 7:14 PM, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
>
> msix_setup_msi_descs() reuses a single stack descriptor for all
> MSI-X entries.
>
> Since msix_prepare_msi_desc() only sets can_mask for non-virtual
> descriptors, a virtual descriptor can inherit can_mask == 1 from
> the preceding real descriptor.
>
> As msi_domain_insert_msi_desc() copies the descriptor, this stale
> value can cause pci_msix_write_vector_ctrl() to access beyond the
> mapped MSI-X table.
>
> Clear the descriptor inside the loop to ensure each MSI-X entry
> starts with can_mask == 0.
>
> Fixes: 3ece3e8e5976 ("PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

I think at some point the can_mask attribute was set in the loop in 
msix_setup_msi_descs(). But this was split with commit 612ad43330d9 
("PCI/MSI: Split MSI-X descriptor setup"), so I think the Fixes tag 
should be applied against that commit?


> ---
>   drivers/pci/msi/msi.c | 3 +--
>   1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
> index a346284..681dd2f 100644
> --- a/drivers/pci/msi/msi.c
> +++ b/drivers/pci/msi/msi.c
> @@ -638,9 +638,8 @@ static int msix_setup_msi_descs(struct pci_dev *dev, struct msix_entry *entries,
>   	struct irq_affinity_desc *curmsk;
>   	struct msi_desc desc;
>   
> -	memset(&desc, 0, sizeof(desc));
> -
>   	for (i = 0, curmsk = masks; i < nvec; i++, curmsk++) {
> +		memset(&desc, 0, sizeof(desc));

I wonder if we can just set can_mask = 0 in the loop rather doing the 
memset every iteration?

Thanks

Farhan

>   		desc.msi_index = entries ? entries[i].entry : i;
>   		desc.affinity = masks ? curmsk : NULL;
>   		desc.pci.msi_attrib.is_virtual = desc.msi_index >= vec_count;