[PATCH] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[PATCH] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

msix_setup_msi_descs() reuses a single stack descriptor for all
MSI-X entries.

Since msix_prepare_msi_desc() only sets can_mask for non-virtual
descriptors, a virtual descriptor can inherit can_mask == 1 from
the preceding real descriptor.

As msi_domain_insert_msi_desc() copies the descriptor, this stale
value can cause pci_msix_write_vector_ctrl() to access beyond the
mapped MSI-X table.

Clear the descriptor inside the loop to ensure each MSI-X entry
starts with can_mask == 0.

Fixes: 3ece3e8e5976 ("PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/pci/msi/msi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
index a346284..681dd2f 100644
--- a/drivers/pci/msi/msi.c
+++ b/drivers/pci/msi/msi.c
@@ -638,9 +638,8 @@ static int msix_setup_msi_descs(struct pci_dev *dev, struct msix_entry *entries,
 	struct irq_affinity_desc *curmsk;
 	struct msi_desc desc;
 
-	memset(&desc, 0, sizeof(desc));
-
 	for (i = 0, curmsk = masks; i < nvec; i++, curmsk++) {
+		memset(&desc, 0, sizeof(desc));
 		desc.msi_index = entries ? entries[i].entry : i;
 		desc.affinity = masks ? curmsk : NULL;
 		desc.pci.msi_attrib.is_virtual = desc.msi_index >= vec_count;
-- 
2.9.4

[tip: irq/msi] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[tip-bot2 for Li RongQing]

The following commit has been merged into the irq/msi branch of tip:

Commit-ID:     3f16c006f1f6aac0d99a85b387f0685fd1bb3a4d
Gitweb:        https://git.kernel.org/tip/3f16c006f1f6aac0d99a85b387f0685fd1bb3a4d
Author:        Li RongQing <lirongqing@baidu.com>
AuthorDate:    Mon, 09 Nov 2026 11:14:11 +08:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Mon, 09 Nov 2026 14:53:18 +01:00

PCI/MSI: Initialize MSI-X descriptors in the setup loop

msix_setup_msi_descs() uses a single on stack MSI descriptor for all MSI-X
entries.

Since msix_prepare_msi_desc() only sets can_mask for non-virtual
descriptors, a virtual descriptor can inherit can_mask == 1 from the
preceding real descriptor.

As msi_domain_insert_msi_desc() copies the descriptor, this stale value can
cause pci_msix_write_vector_ctrl() to access beyond the mapped MSI-X table.

Clear the descriptor inside the loop to ensure each MSI-X entry starts with
can_mask == 0.

[ tglx: Move declaration into the loop ]

Fixes: 3ece3e8e5976 ("PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20261109031411.2205-1-lirongqing@baidu.com
---
 drivers/pci/msi/msi.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
index 8a0133a..4e8ec8d 100644
--- a/drivers/pci/msi/msi.c
+++ b/drivers/pci/msi/msi.c
@@ -636,11 +636,10 @@ static int msix_setup_msi_descs(struct pci_dev *dev, struct msix_entry *entries,
 {
 	int ret = 0, i, vec_count = pci_msix_vec_count(dev);
 	struct irq_affinity_desc *curmsk;
-	struct msi_desc desc;
-
-	memset(&desc, 0, sizeof(desc));
 
 	for (i = 0, curmsk = masks; i < nvec; i++, curmsk++) {
+		struct msi_desc desc = { };
+
 		desc.msi_index = entries ? entries[i].entry : i;
 		desc.affinity = masks ? curmsk : NULL;
 		desc.pci.msi_attrib.is_virtual = desc.msi_index >= vec_count;

Re: [PATCH] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[Farhan Ali]

Hi Li,

On 11/8/2026 7:14 PM, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
>
> msix_setup_msi_descs() reuses a single stack descriptor for all
> MSI-X entries.
>
> Since msix_prepare_msi_desc() only sets can_mask for non-virtual
> descriptors, a virtual descriptor can inherit can_mask == 1 from
> the preceding real descriptor.
>
> As msi_domain_insert_msi_desc() copies the descriptor, this stale
> value can cause pci_msix_write_vector_ctrl() to access beyond the
> mapped MSI-X table.
>
> Clear the descriptor inside the loop to ensure each MSI-X entry
> starts with can_mask == 0.
>
> Fixes: 3ece3e8e5976 ("PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

I think at some point the can_mask attribute was set in the loop in 
msix_setup_msi_descs(). But this was split with commit 612ad43330d9 
("PCI/MSI: Split MSI-X descriptor setup"), so I think the Fixes tag 
should be applied against that commit?


> ---
>   drivers/pci/msi/msi.c | 3 +--
>   1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
> index a346284..681dd2f 100644
> --- a/drivers/pci/msi/msi.c
> +++ b/drivers/pci/msi/msi.c
> @@ -638,9 +638,8 @@ static int msix_setup_msi_descs(struct pci_dev *dev, struct msix_entry *entries,
>   	struct irq_affinity_desc *curmsk;
>   	struct msi_desc desc;
>   
> -	memset(&desc, 0, sizeof(desc));
> -
>   	for (i = 0, curmsk = masks; i < nvec; i++, curmsk++) {
> +		memset(&desc, 0, sizeof(desc));

I wonder if we can just set can_mask = 0 in the loop rather doing the 
memset every iteration?

Thanks

Farhan

>   		desc.msi_index = entries ? entries[i].entry : i;
>   		desc.affinity = masks ? curmsk : NULL;
>   		desc.pci.msi_attrib.is_virtual = desc.msi_index >= vec_count;