Re: [PATCH v3 8/8] s390/pci: Unregister the adapter interrupt first in zpci_irq_exit()

["Tobias Schumacher" <ts@linux.ibm.com>]

On Fri Oct 9, 2026 at 8:29 AM CEST, sashiko-bot wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] s390/pci: UAF memory corruption in MSI setup due to missing device teardown
> --
>
> commit 4f6e192e648a7af5752afbd15f3be9f0172b9594
> Author: Tobias Schumacher <ts@linux.ibm.com>
>
> s390/pci: Unregister the adapter interrupt first in zpci_irq_exit()
>
> This commit modifies zpci_irq_exit() to unregister the adapter interrupt before
> freeing the interrupt bit vectors. This aims to prevent vectors from being
> freed under a live handler during the pci_base_init() error path.
>
>> diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
>> index 4b8ebb987580b..16ae80ed2d139 100644
>> --- a/arch/s390/pci/pci_irq.c
>> +++ b/arch/s390/pci/pci_irq.c
>> @@ -674,6 +674,7 @@ void __init zpci_irq_exit(void)
>>  {
>>  	unsigned int cpu;
>>
>> +	unregister_adapter_interrupt(&zpci_airq);
>>  	if (irq_delivery == DIRECTED) {
>>  		for_each_possible_cpu(cpu) {
>>  			airq_iv_release(zpci_dibv[cpu]);
>> @@ -684,5 +685,4 @@ void __init zpci_irq_exit(void)
>>  	}
>>  	if (zpci_sbv)
>>  		airq_iv_release(zpci_sbv);
>
> [Severity: High]
> Does this change fully resolve the use-after-free risk in the pci_base_init()
> error path?
>
> While moving unregister_adapter_interrupt() prevents the interrupt handler
> from accessing the vectors while they are being freed, it appears the devices
> registered earlier by zpci_scan_devices() are never unregistered when
> pci_base_init() fails during zpci_fw_sysfs_init().
>
> If a driver later binds to one of these still-registered devices and calls
> pci_alloc_irq_vectors(), the PCI MSI setup accesses the freed zpci_sbv
> and zpci_ibv structures:
>
> arch/s390/pci/pci_irq.c:__alloc_airq() {
>     ...
>     /* Allocate adapter summary indicator bit */
>     *bit = airq_iv_alloc_bit(zpci_sbv);
>     ...
>     /* Wire up shortcut pointer */
>     rcu_assign_pointer(zpci_ibv[*bit], zdev->aibv);
>     ...
> }
>
> Could this lead to memory corruption when a driver attempts to set up MSI on
> a device that was not properly torn down?

Right, this issue exists but is not addressed by this patch. This series
fixes and cleans the s390 PCI IRQ code, so I'll fix that in a separate patch
outside this series.

Thanks
Tobias