[PATCH 0/7] s390/pci: Fix multiple bugs in IRQ domain migration

[PATCH 0/7] s390/pci: Fix multiple bugs in IRQ domain migration

[Tobias Schumacher]

Commit f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ
domain API") introduced several bugs in error handling and cleanup
paths. This series fixes these issues:

1. Null pointer dereference and double-free in MSI cleanup
2. Use-after-free race in floating interrupt cleanup
3. Resource leak in MSI setup error path
4. Wrong number of IRQs freed in directed-mode teardown
5. Missing NULL checks in zpci_msi_clear_airq()
6. Resource leak in zpci_directed_irq_init() error path
7. Inefficient MSI affinity flag initialization

Patches 1-6 fix critical bugs that can cause crashes, memory
corruption, or resource exhaustion. Patch 7 is a cleanup that moves
flag initialization to a more appropriate location.

Tobias Schumacher (7):
  s390/pci: fix null pointer dereference and double-free in zpci MSI cleanup
  s390/pci: fix use-after-free race in zpci floating interrupt cleanup
  s390/pci: fix resource leak in zpci MSI setup
  s390/pci: fix MSI directed-mode teardown IRQ bit count
  s390/pci: add NULL check in zpci_msi_clear_airq()
  s390/pci: add error cleanup in zpci_directed_irq_init
  s390/pci: move MSI affinity flag initialization to boot time

Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
---
Tobias Schumacher (7):
      s390/pci: fix double-free in zpci MSI cleanup
      s390/pci: fix use-after-free race in zpci floating interrupt cleanup
      s390/pci: fix resource leak in zpci MSI setup
      s390/pci: fix MSI directed-mode teardown IRQ bit count
      s390/pci: add NULL check in zpci_msi_clear_airq()
      s390/pci: add error cleanup in zpci_directed_irq_init
      s390/pci: move MSI affinity flag initialization to boot time

 arch/s390/pci/pci_irq.c | 59 ++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 46 insertions(+), 13 deletions(-)
---
base-commit: ff35cca8fb33b213bb41a20d7ed27ecf0fc3152a
change-id: 20260818-s390_irq_domain_fixes-ad74b3134c51

Best regards,
-- 
Tobias Schumacher <ts@linux.ibm.com>

[PATCH 1/7] s390/pci: fix double-free in zpci MSI cleanup

[Tobias Schumacher]

zpci_remove_parent_msi_domain() can be called multiple times on the
same zbus, causing a double-free. This occurs when pci_create_root_bus()
fails after successful MSI domain creation in zpci_bus_create_pci_bus():
the error path calls zpci_remove_parent_msi_domain() to clean up, but
doesn't NULL the pointer. Later, when zpci_bus_release() is called via
kref_put(), it calls zpci_remove_parent_msi_domain() again, attempting
to free the already-freed domain and fwnode.

Add NULL check at function entry and NULL the pointer after cleanup to
make the function idempotent and safe for multiple calls.

Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
---
 arch/s390/pci/pci_irq.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index 9c9ed3d8d959..c9520a16ca75 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -533,9 +533,13 @@ void zpci_remove_parent_msi_domain(struct zpci_bus *zbus)
 {
 	struct fwnode_handle *fn;
 
+	if (!zbus->msi_parent_domain)
+		return;
+
 	fn = zbus->msi_parent_domain->fwnode;
 	irq_domain_remove(zbus->msi_parent_domain);
 	irq_domain_free_fwnode(fn);
+	zbus->msi_parent_domain = NULL;
 }
 
 static void __init cpu_enable_directed_irq(void *unused)

-- 
2.53.0

[PATCH 2/7] s390/pci: fix use-after-free race in zpci floating interrupt cleanup

[Tobias Schumacher]

The interrupt handler reads zpci_ibv[si] without synchronization while
concurrent teardown can release this memory, creating a race:
- handler reads the pointer,
- then teardown frees memory,
- then handler uses the freed pointer.
Fix by protecting array access with RCU synchronization.

Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
---
 arch/s390/pci/pci_irq.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index c9520a16ca75..94b03d16006b 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -278,8 +278,14 @@ static void zpci_floating_irq_handler(struct airq_struct *airq,
 			continue;
 		}
 
+		rcu_read_lock();
+
 		/* Scan the adapter interrupt vector for this device. */
-		aibv = zpci_ibv[si];
+		aibv = rcu_dereference(zpci_ibv[si]);
+		if (!aibv) {
+			rcu_read_unlock();
+			continue;
+		}
 		for (ai = 0;;) {
 			ai = airq_iv_scan(aibv, ai, airq_iv_end(aibv));
 			if (ai == -1UL)
@@ -291,6 +297,7 @@ static void zpci_floating_irq_handler(struct airq_struct *airq,
 			generic_handle_domain_irq(msi_domain, hwirq);
 			airq_iv_unlock(aibv, ai);
 		}
+		rcu_read_unlock();
 	}
 }
 
@@ -346,9 +353,12 @@ static void zpci_msi_teardown_directed(struct zpci_dev *zdev)
 
 static void zpci_msi_teardown_floating(struct zpci_dev *zdev)
 {
+	airq_iv_free_bit(zpci_sbv, zdev->aisb);
+	zpci_ibv[zdev->aisb] = NULL;
+	synchronize_rcu();
+
 	airq_iv_release(zdev->aibv);
 	zdev->aibv = NULL;
-	airq_iv_free_bit(zpci_sbv, zdev->aisb);
 	zdev->aisb = -1UL;
 	zdev->msi_first_bit = -1U;
 	zdev->msi_nr_irqs = 0;

-- 
2.53.0

[PATCH 3/7] s390/pci: fix resource leak in zpci MSI setup

[Tobias Schumacher]

If airq_iv_create() fails in __alloc_airq(), the zpci_sbv bit allocated
by airq_iv_alloc_bit() is never freed. This permanently leaks one of the
ZPCI_NR_DEVICES summary bits (~128 total), reducing system capacity with
each failed device hotplug. In systems with repeated device insertion
failures or under memory pressure, all summary bits can be exhausted,
preventing new PCI devices from being added until reboot.

Add proper error handling to free the zpci_sbv bit and reset zdev->aisb
if the AIBV creation fails.

Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
---
 arch/s390/pci/pci_irq.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index 94b03d16006b..5e934ac990ac 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -320,8 +320,11 @@ static int __alloc_airq(struct zpci_dev *zdev, int msi_vecs,
 		zdev->aibv = airq_iv_create(msi_vecs,
 					    AIRQ_IV_PTR | AIRQ_IV_DATA | AIRQ_IV_BITLOCK,
 					    NULL);
-		if (!zdev->aibv)
+		if (!zdev->aibv) {
+			airq_iv_free_bit(zpci_sbv, *bit);
+			zdev->aisb = -1UL;
 			return -ENOMEM;
+		}
 
 		/* Wire up shortcut pointer */
 		zpci_ibv[*bit] = zdev->aibv;

-- 
2.53.0

[PATCH 4/7] s390/pci: fix MSI directed-mode teardown IRQ bit count

[Tobias Schumacher]

On s390 with directed interrupts enabled, zpci_msi_teardown_directed()
frees the platform's maximum number of MSI bits (zdev->max_msi) instead
of the actual allocated count (zdev->msi_nr_irqs). This corrupts the
shared IRQ bitmap used by all PCI functions, causing lost interrupts and
heap corruption. Fix zpci_msi_teardown_directed() to only free the
actual allocated IRQ bit count.

Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
---
 arch/s390/pci/pci_irq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index 5e934ac990ac..e9eda846cb2d 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -349,7 +349,7 @@ static struct airq_struct zpci_airq = {
 
 static void zpci_msi_teardown_directed(struct zpci_dev *zdev)
 {
-	airq_iv_free(zpci_ibv[0], zdev->msi_first_bit, zdev->max_msi);
+	airq_iv_free(zpci_ibv[0], zdev->msi_first_bit, zdev->msi_nr_irqs);
 	zdev->msi_first_bit = -1U;
 	zdev->msi_nr_irqs = 0;
 }

-- 
2.53.0

[PATCH 5/7] s390/pci: add NULL check in zpci_msi_clear_airq()

[Tobias Schumacher]

zpci_msi_clear_airq() clears IRQ data in both DIRECTED and FLOATING
modes but does not check if the interrupt vector pointers are NULL
before dereferencing them.

In DIRECTED mode, zpci_ibv[cpu] can be NULL if:
- zpci_directed_irq_init() fails during boot after allocating some
  but not all per-CPU vectors, and cleanup is attempted
- The system is shutting down and zpci_irq_exit() has already
  released some vectors

In FLOATING mode, zdev->aibv can be NULL if:
- zpci_msi_prepare() fails after __alloc_airq() but before setting
  up the device's AIBV, and zpci_msi_domain_free() is called during
  error cleanup
- The device is being torn down and zpci_msi_teardown_floating()
  has already released the AIBV

Add NULL checks for zpci_ibv[cpu] in DIRECTED mode and zdev->aibv in
FLOATING mode to prevent crashes during these error and shutdown paths.

Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
---
 arch/s390/pci/pci_irq.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index e9eda846cb2d..1515d8d7460e 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -465,12 +465,16 @@ static void zpci_msi_clear_airq(struct irq_data *d, int i)
 
 	if (irq_delivery == DIRECTED) {
 		for_each_possible_cpu(cpu) {
-			airq_iv_set_ptr(zpci_ibv[cpu], bit + i, 0);
-			airq_iv_set_data(zpci_ibv[cpu], bit + i, 0);
+			if (zpci_ibv[cpu]) {
+				airq_iv_set_ptr(zpci_ibv[cpu], bit + i, 0);
+				airq_iv_set_data(zpci_ibv[cpu], bit + i, 0);
+			}
 		}
 	} else {
-		airq_iv_set_ptr(zdev->aibv, bit + i, 0);
-		airq_iv_set_data(zdev->aibv, bit + i, 0);
+		if (zdev->aibv) {
+			airq_iv_set_ptr(zdev->aibv, bit + i, 0);
+			airq_iv_set_data(zdev->aibv, bit + i, 0);
+		}
 	}
 }
 

-- 
2.53.0

[PATCH 6/7] s390/pci: add error cleanup in zpci_directed_irq_init

[Tobias Schumacher]

If per-CPU airq_iv allocation fails in the loop, previously allocated
vectors and arrays leak. Add proper error path to release all resources
on failure.

Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
---
 arch/s390/pci/pci_irq.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index 1515d8d7460e..1ddf6b3625a2 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -586,7 +586,7 @@ static int __init zpci_directed_irq_init(void)
 
 	zpci_ibv = kzalloc_objs(*zpci_ibv, num_possible_cpus());
 	if (!zpci_ibv)
-		return -ENOMEM;
+		goto out_free_sbv;
 
 	for_each_possible_cpu(cpu) {
 		/*
@@ -599,13 +599,25 @@ static int __init zpci_directed_irq_init(void)
 					       AIRQ_IV_CACHELINE |
 					       (!cpu ? AIRQ_IV_ALLOC : 0), NULL);
 		if (!zpci_ibv[cpu])
-			return -ENOMEM;
+			goto out_free_ibv;
 	}
 	on_each_cpu(cpu_enable_directed_irq, NULL, 1);
 
 	zpci_irq_chip.irq_set_affinity = zpci_set_irq_affinity;
 
 	return 0;
+
+out_free_ibv:
+	for_each_possible_cpu(cpu) {
+		if (zpci_ibv[cpu])
+			airq_iv_release(zpci_ibv[cpu]);
+	}
+	kfree(zpci_ibv);
+	zpci_ibv = NULL;
+out_free_sbv:
+	airq_iv_release(zpci_sbv);
+	zpci_sbv = NULL;
+	return -ENOMEM;
 }
 
 static int __init zpci_floating_irq_init(void)

-- 
2.53.0

[PATCH 7/7] s390/pci: move MSI affinity flag initialization to boot time

[Tobias Schumacher]

The MSI_FLAG_NO_AFFINITY flag for FLOATING mode is currently set lazily
in zpci_create_parent_msi_domain(), which may be called multiple times
when discovering PCI buses. While setting the flag multiple times is a
no-op due to its idempotent nature, this is inefficient and unclear.

Since irq_delivery mode is determined once at boot time and never
changes, move the flag initialization to zpci_irq_init() where it
belongs. This clarifies intent and avoids redundant repeated operations
on the shared structure.

Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
---
 arch/s390/pci/pci_irq.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
index 1ddf6b3625a2..ed19f7cce9eb 100644
--- a/arch/s390/pci/pci_irq.c
+++ b/arch/s390/pci/pci_irq.c
@@ -533,9 +533,6 @@ int zpci_create_parent_msi_domain(struct zpci_bus *zbus)
 		return -ENOMEM;
 	}
 
-	if (irq_delivery == FLOATING)
-		zpci_msi_parent_ops.required_flags |= MSI_FLAG_NO_AFFINITY;
-
 	zbus->msi_parent_domain = msi_create_parent_irq_domain(&info, &zpci_msi_parent_ops);
 	if (!zbus->msi_parent_domain) {
 		irq_domain_free_fwnode(info.fwnode);
@@ -646,6 +643,9 @@ int __init zpci_irq_init(void)
 	if (s390_pci_force_floating)
 		irq_delivery = FLOATING;
 
+	if (irq_delivery == FLOATING)
+		zpci_msi_parent_ops.required_flags |= MSI_FLAG_NO_AFFINITY;
+
 	if (irq_delivery == DIRECTED)
 		zpci_airq.handler = zpci_directed_irq_handler;
 

-- 
2.53.0

Re: [PATCH 0/7] s390/pci: Fix multiple bugs in IRQ domain migration

[Niklas Schnelle]

On Wed, 2026-08-19 at 10:50 +0200, Tobias Schumacher wrote:
> Commit f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ
> domain API") introduced several bugs in error handling and cleanup
> paths. This series fixes these issues:
> 
> 1. Null pointer dereference and double-free in MSI cleanup
> 2. Use-after-free race in floating interrupt cleanup
> 3. Resource leak in MSI setup error path
> 4. Wrong number of IRQs freed in directed-mode teardown
> 5. Missing NULL checks in zpci_msi_clear_airq()
> 6. Resource leak in zpci_directed_irq_init() error path
> 7. Inefficient MSI affinity flag initialization
> 
> Patches 1-6 fix critical bugs that can cause crashes, memory
> corruption, or resource exhaustion. Patch 7 is a cleanup that moves
> flag initialization to a more appropriate location.
> 
> Tobias Schumacher (7):
>   s390/pci: fix null pointer dereference and double-free in zpci MSI cleanup
>   s390/pci: fix use-after-free race in zpci floating interrupt cleanup
>   s390/pci: fix resource leak in zpci MSI setup
>   s390/pci: fix MSI directed-mode teardown IRQ bit count
>   s390/pci: add NULL check in zpci_msi_clear_airq()
>   s390/pci: add error cleanup in zpci_directed_irq_init
>   s390/pci: move MSI affinity flag initialization to boot time

Nit: On all patches, s390 uses a capital letter after the "s390/xyz:"
prefix. See here:
https://github.ibm.com/linuxonz/development-wiki/blob/master/wiki/linux-development-guide/kernel.md#Patch-subject

Thanks,
Niklas