[PATCH v2 0/3] PCI: endpoint: Doorbell-related fixes

[PATCH v2 0/3] PCI: endpoint: Doorbell-related fixes

[Koichiro Den]

Hi,

This is a small fix-only series related to the previous (v6)
doorbell-related series:
https://lore.kernel.org/linux-pci/20260209125316.2132589-1-den@valinux.co.jp/

These patches address a few independent fixes in pci-epf-vntb,
pci-epf-test and pci-ep-msi:

  1/3 fixes IRQ unwind in MSI doorbell setup (pci-epf-vntb)
  2/3 avoids free_irq() if doorbell IRQ was not successfully requested
      (pci-epf-test)
  3/3 fixes error unwind and prevent double allocation in
      pci_epf_alloc_doorbell() (pci-ep-msi)

These fixes were originally intended to be included in the next revision
of the main series. However, doing so would have grown the v7 series to
around 15 patches, so I am posting them separately to keep the feature
series manageable.

Kind regards,
Koichiro

---
Changes in v2:
  - Removed a minor refactoring part from [PATCH 1/4], keeping the iterator type
    int, rather than changing it to unsigned int.
  - Dropped [PATCH 2/4] (bounds check). It's a theoretical future-proofing guard
    rather than a fix for today.
  - Dropped the db_irq_requested flag and instead moved free_irq() to the
    appropriate call sites.

v1: https://lore.kernel.org/linux-pci/20260215150914.3392479-1-den@valinux.co.jp/
---

Koichiro Den (3):
  PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind
  PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested
  PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc

 drivers/pci/endpoint/functions/pci-epf-test.c |  8 +++++---
 drivers/pci/endpoint/functions/pci-epf-vntb.c | 12 ++++++------
 drivers/pci/endpoint/pci-ep-msi.c             |  5 +++++
 3 files changed, 16 insertions(+), 9 deletions(-)

-- 
2.51.0

[PATCH v2 1/3] PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind

[Koichiro Den]

epf_ntb_db_bar_init_msi_doorbell() requests ntb->db_count doorbell IRQs
and then performs additional MSI doorbell setup that may still fail.
The error path unwinds the requested IRQs, but it uses a loop variable
that is reused later in the function. When a later step fails, the
unwind can run with an unexpected index value and leave some IRQs
requested.

Track the number of successfully requested IRQs separately and use that
counter for the unwind so all previously requested IRQs are freed on
failure.

Fixes: dc693d606644 ("PCI: endpoint: pci-epf-vntb: Add MSI doorbell support")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
 drivers/pci/endpoint/functions/pci-epf-vntb.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
index 20a400e83439..52cf442ca1d9 100644
--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
+++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
@@ -527,20 +527,20 @@ static int epf_ntb_db_bar_init_msi_doorbell(struct epf_ntb *ntb,
 	struct msi_msg *msg;
 	size_t sz;
 	int ret;
-	int i;
+	int i, req;
 
 	ret = pci_epf_alloc_doorbell(epf,  ntb->db_count);
 	if (ret)
 		return ret;
 
-	for (i = 0; i < ntb->db_count; i++) {
-		ret = request_irq(epf->db_msg[i].virq, epf_ntb_doorbell_handler,
+	for (req = 0; req < ntb->db_count; req++) {
+		ret = request_irq(epf->db_msg[req].virq, epf_ntb_doorbell_handler,
 				  0, "pci_epf_vntb_db", ntb);
 
 		if (ret) {
 			dev_err(&epf->dev,
 				"Failed to request doorbell IRQ: %d\n",
-				epf->db_msg[i].virq);
+				epf->db_msg[req].virq);
 			goto err_free_irq;
 		}
 	}
@@ -598,8 +598,8 @@ static int epf_ntb_db_bar_init_msi_doorbell(struct epf_ntb *ntb,
 	return 0;
 
 err_free_irq:
-	for (i--; i >= 0; i--)
-		free_irq(epf->db_msg[i].virq, ntb);
+	for (req--; req >= 0; req--)
+		free_irq(epf->db_msg[req].virq, ntb);
 
 	pci_epf_free_doorbell(ntb->epf);
 	return ret;
-- 
2.51.0

Re: [PATCH v2 1/3] PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind

[Niklas Cassel]

On Tue, Feb 17, 2026 at 03:38:54PM +0900, Koichiro Den wrote:
> epf_ntb_db_bar_init_msi_doorbell() requests ntb->db_count doorbell IRQs
> and then performs additional MSI doorbell setup that may still fail.
> The error path unwinds the requested IRQs, but it uses a loop variable
> that is reused later in the function. When a later step fails, the
> unwind can run with an unexpected index value and leave some IRQs
> requested.
> 
> Track the number of successfully requested IRQs separately and use that
> counter for the unwind so all previously requested IRQs are freed on
> failure.
> 
> Fixes: dc693d606644 ("PCI: endpoint: pci-epf-vntb: Add MSI doorbell support")
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---

Reviewed-by: Niklas Cassel <cassel@kernel.org>

Re: [PATCH v2 1/3] PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind

[Frank Li]

On Tue, Feb 17, 2026 at 03:38:54PM +0900, Koichiro Den wrote:
> epf_ntb_db_bar_init_msi_doorbell() requests ntb->db_count doorbell IRQs
> and then performs additional MSI doorbell setup that may still fail.
> The error path unwinds the requested IRQs, but it uses a loop variable
> that is reused later in the function. When a later step fails, the
> unwind can run with an unexpected index value and leave some IRQs
> requested.
>
> Track the number of successfully requested IRQs separately and use that
> counter for the unwind so all previously requested IRQs are freed on
> failure.
>
> Fixes: dc693d606644 ("PCI: endpoint: pci-epf-vntb: Add MSI doorbell support")
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/pci/endpoint/functions/pci-epf-vntb.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> index 20a400e83439..52cf442ca1d9 100644
> --- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
> @@ -527,20 +527,20 @@ static int epf_ntb_db_bar_init_msi_doorbell(struct epf_ntb *ntb,
>  	struct msi_msg *msg;
>  	size_t sz;
>  	int ret;
> -	int i;
> +	int i, req;
>
>  	ret = pci_epf_alloc_doorbell(epf,  ntb->db_count);
>  	if (ret)
>  		return ret;
>
> -	for (i = 0; i < ntb->db_count; i++) {
> -		ret = request_irq(epf->db_msg[i].virq, epf_ntb_doorbell_handler,
> +	for (req = 0; req < ntb->db_count; req++) {
> +		ret = request_irq(epf->db_msg[req].virq, epf_ntb_doorbell_handler,
>  				  0, "pci_epf_vntb_db", ntb);
>
>  		if (ret) {
>  			dev_err(&epf->dev,
>  				"Failed to request doorbell IRQ: %d\n",
> -				epf->db_msg[i].virq);
> +				epf->db_msg[req].virq);
>  			goto err_free_irq;
>  		}
>  	}
> @@ -598,8 +598,8 @@ static int epf_ntb_db_bar_init_msi_doorbell(struct epf_ntb *ntb,
>  	return 0;
>
>  err_free_irq:
> -	for (i--; i >= 0; i--)
> -		free_irq(epf->db_msg[i].virq, ntb);
> +	for (req--; req >= 0; req--)
> +		free_irq(epf->db_msg[req].virq, ntb);
>
>  	pci_epf_free_doorbell(ntb->epf);
>  	return ret;
> --
> 2.51.0
>

[PATCH v2 2/3] PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested

[Koichiro Den]

pci_epf_test_doorbell_cleanup() unconditionally calls free_irq() for the
doorbell virq, which can trigger "Trying to free already-free IRQ"
warnings when the IRQ was never requested or when request_threaded_irq()
failed.

Move free_irq() out of pci_epf_test_doorbell_cleanup() and invoke it
only after a successful request, so that free_irq() is not called for
an unrequested IRQ.

Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
 drivers/pci/endpoint/functions/pci-epf-test.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index 0cb7af0919dc..12705858e502 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -715,7 +715,6 @@ static void pci_epf_test_doorbell_cleanup(struct pci_epf_test *epf_test)
 	struct pci_epf_test_reg *reg = epf_test->reg[epf_test->test_reg_bar];
 	struct pci_epf *epf = epf_test->epf;
 
-	free_irq(epf->db_msg[0].virq, epf_test);
 	reg->doorbell_bar = cpu_to_le32(NO_BAR);
 
 	pci_epf_free_doorbell(epf);
@@ -759,7 +758,7 @@ static void pci_epf_test_enable_doorbell(struct pci_epf_test *epf_test,
 					 &epf_test->db_bar.phys_addr, &offset);
 
 	if (ret)
-		goto err_doorbell_cleanup;
+		goto err_free_irq;
 
 	reg->doorbell_offset = cpu_to_le32(offset);
 
@@ -769,12 +768,14 @@ static void pci_epf_test_enable_doorbell(struct pci_epf_test *epf_test,
 
 	ret = pci_epc_set_bar(epc, epf->func_no, epf->vfunc_no, &epf_test->db_bar);
 	if (ret)
-		goto err_doorbell_cleanup;
+		goto err_free_irq;
 
 	status |= STATUS_DOORBELL_ENABLE_SUCCESS;
 	reg->status = cpu_to_le32(status);
 	return;
 
+err_free_irq:
+	free_irq(epf->db_msg[0].virq, epf_test);
 err_doorbell_cleanup:
 	pci_epf_test_doorbell_cleanup(epf_test);
 set_status_err:
@@ -794,6 +795,7 @@ static void pci_epf_test_disable_doorbell(struct pci_epf_test *epf_test,
 	if (bar < BAR_0)
 		goto set_status_err;
 
+	free_irq(epf->db_msg[0].virq, epf_test);
 	pci_epf_test_doorbell_cleanup(epf_test);
 
 	/*
-- 
2.51.0

Re: [PATCH v2 2/3] PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested

[Niklas Cassel]

On Tue, Feb 17, 2026 at 03:38:55PM +0900, Koichiro Den wrote:
> pci_epf_test_doorbell_cleanup() unconditionally calls free_irq() for the
> doorbell virq, which can trigger "Trying to free already-free IRQ"
> warnings when the IRQ was never requested or when request_threaded_irq()
> failed.
> 
> Move free_irq() out of pci_epf_test_doorbell_cleanup() and invoke it
> only after a successful request, so that free_irq() is not called for
> an unrequested IRQ.
> 
> Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support")
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---

Reviewed-by: Niklas Cassel <cassel@kernel.org>

Re: [PATCH v2 2/3] PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested

[Frank Li]

On Tue, Feb 17, 2026 at 03:38:55PM +0900, Koichiro Den wrote:
> pci_epf_test_doorbell_cleanup() unconditionally calls free_irq() for the
> doorbell virq, which can trigger "Trying to free already-free IRQ"
> warnings when the IRQ was never requested or when request_threaded_irq()
> failed.
>
> Move free_irq() out of pci_epf_test_doorbell_cleanup() and invoke it
> only after a successful request, so that free_irq() is not called for
> an unrequested IRQ.
>
> Fixes: eff0c286aa91 ("PCI: endpoint: pci-epf-test: Add doorbell test support")
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---
Reviewed-by: Frank Li <Frank.Li@nxp.com>
>  drivers/pci/endpoint/functions/pci-epf-test.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
> index 0cb7af0919dc..12705858e502 100644
> --- a/drivers/pci/endpoint/functions/pci-epf-test.c
> +++ b/drivers/pci/endpoint/functions/pci-epf-test.c
> @@ -715,7 +715,6 @@ static void pci_epf_test_doorbell_cleanup(struct pci_epf_test *epf_test)
>  	struct pci_epf_test_reg *reg = epf_test->reg[epf_test->test_reg_bar];
>  	struct pci_epf *epf = epf_test->epf;
>
> -	free_irq(epf->db_msg[0].virq, epf_test);
>  	reg->doorbell_bar = cpu_to_le32(NO_BAR);
>
>  	pci_epf_free_doorbell(epf);
> @@ -759,7 +758,7 @@ static void pci_epf_test_enable_doorbell(struct pci_epf_test *epf_test,
>  					 &epf_test->db_bar.phys_addr, &offset);
>
>  	if (ret)
> -		goto err_doorbell_cleanup;
> +		goto err_free_irq;
>
>  	reg->doorbell_offset = cpu_to_le32(offset);
>
> @@ -769,12 +768,14 @@ static void pci_epf_test_enable_doorbell(struct pci_epf_test *epf_test,
>
>  	ret = pci_epc_set_bar(epc, epf->func_no, epf->vfunc_no, &epf_test->db_bar);
>  	if (ret)
> -		goto err_doorbell_cleanup;
> +		goto err_free_irq;
>
>  	status |= STATUS_DOORBELL_ENABLE_SUCCESS;
>  	reg->status = cpu_to_le32(status);
>  	return;
>
> +err_free_irq:
> +	free_irq(epf->db_msg[0].virq, epf_test);
>  err_doorbell_cleanup:
>  	pci_epf_test_doorbell_cleanup(epf_test);
>  set_status_err:
> @@ -794,6 +795,7 @@ static void pci_epf_test_disable_doorbell(struct pci_epf_test *epf_test,
>  	if (bar < BAR_0)
>  		goto set_status_err;
>
> +	free_irq(epf->db_msg[0].virq, epf_test);
>  	pci_epf_test_doorbell_cleanup(epf_test);
>
>  	/*
> --
> 2.51.0
>

[PATCH v2 3/3] PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc

[Koichiro Den]

pci_epf_alloc_doorbell() stores the allocated doorbell message array in
epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation
fails, the array is freed but the EPF state may still point to freed
memory.

Clear epf->db_msg and epf->num_db on the MSI allocation failure path so
that later cleanup cannot double-free the array and callers can retry
allocation.

Also return -EBUSY when doorbells have already been allocated to prevent
leaking or overwriting an existing allocation.

Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
 drivers/pci/endpoint/pci-ep-msi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c
index 1b58357b905f..ad8a81d6ad77 100644
--- a/drivers/pci/endpoint/pci-ep-msi.c
+++ b/drivers/pci/endpoint/pci-ep-msi.c
@@ -50,6 +50,9 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
 		return -EINVAL;
 	}
 
+	if (epf->db_msg)
+		return -EBUSY;
+
 	domain = of_msi_map_get_device_domain(epc->dev.parent, 0,
 					      DOMAIN_BUS_PLATFORM_MSI);
 	if (!domain) {
@@ -79,6 +82,8 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
 	if (ret) {
 		dev_err(dev, "Failed to allocate MSI\n");
 		kfree(msg);
+		epf->db_msg = NULL;
+		epf->num_db = 0;
 		return ret;
 	}
 
-- 
2.51.0

Re: [PATCH v2 0/3] PCI: endpoint: Doorbell-related fixes

[Manivannan Sadhasivam]

On Tue, 17 Feb 2026 15:38:53 +0900, Koichiro Den wrote:
> This is a small fix-only series related to the previous (v6)
> doorbell-related series:
> https://lore.kernel.org/linux-pci/20260209125316.2132589-1-den@valinux.co.jp/
> 
> These patches address a few independent fixes in pci-epf-vntb,
> pci-epf-test and pci-ep-msi:
> 
> [...]

Applied, thanks!

[1/3] PCI: endpoint: pci-epf-vntb: Fix MSI doorbell IRQ unwind
      commit: d61ad1bf4cd447f023eaf801dd836ce2c8d579dc
[2/3] PCI: endpoint: pci-epf-test: Don't free doorbell IRQ unless requested
      commit: 18b1650d6850040ebe7612504b9cf5e86dd48d84
[3/3] PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc
      commit: 53f49de2df2790db085d1ddf3a2251fd7b1d960b

Best regards,
-- 
Manivannan Sadhasivam <mani@kernel.org>