Commit 78e7b15e authored by Radu Rendec's avatar Radu Rendec Committed by Michael Ellerman
Browse files

powerpc/msi: Fix NULL pointer access in teardown code

The arch_teardown_msi_irqs() function assumes that controller ops
pointers were already checked in arch_setup_msi_irqs(), but this
assumption is wrong: arch_teardown_msi_irqs() can be called even when
arch_setup_msi_irqs() returns an error (-ENOSYS).

This can happen in the following scenario:
  - msi_capability_init() calls pci_msi_setup_msi_irqs()
  - pci_msi_setup_msi_irqs() returns -ENOSYS
  - msi_capability_init() notices the error and calls free_msi_irqs()
  - free_msi_irqs() calls pci_msi_teardown_msi_irqs()

This is easier to see when CONFIG_PCI_MSI_IRQ_DOMAIN is not set and
pci_msi_setup_msi_irqs() and pci_msi_teardown_msi_irqs() are just
aliases to arch_setup_msi_irqs() and arch_teardown_msi_irqs().

The call to free_msi_irqs() upon pci_msi_setup_msi_irqs() failure
seems legit, as it does additional cleanup; e.g.
list_del(&entry->list) and kfree(entry) inside free_msi_irqs() do
happen (MSI descriptors are allocated before pci_msi_setup_msi_irqs()
is called and need to be cleaned up if that fails).

Fixes: 6b2fd7ef

 ("PCI/MSI/PPC: Remove arch_msi_check_device()")
Cc: # v3.18+
Signed-off-by: default avatarRadu Rendec <>
Signed-off-by: default avatarMichael Ellerman <>
parent 462951cd
......@@ -34,5 +34,10 @@ void arch_teardown_msi_irqs(struct pci_dev *dev)
struct pci_controller *phb = pci_bus_to_host(dev->bus);
* We can be called even when arch_setup_msi_irqs() returns -ENOSYS,
* so check the pointer again.
if (phb->controller_ops.teardown_msi_irqs)
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment