Commit 1d8e3467 authored by Jinjie Ruan's avatar Jinjie Ruan Committed by Lin Yujun
Browse files

genirq/msi: Fix off-by-one error in msi_domain_alloc() 

mainline inclusion
from mainline-v6.12-rc6
commit 5f994f534120f47432092fb36f5cb0c7a80ed2bf
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBFOBV

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f994f534120f47432092fb36f5cb0c7a80ed2bf



--------------------------------

The error path in msi_domain_alloc(), frees the already allocated MSI
interrupts in a loop, but the loop condition terminates when the index
reaches zero, which fails to free the first allocated MSI interrupt at
index zero.

Check for >= 0 so that msi[0] is freed as well.

Fixes: f3cf8bb0 ("genirq: Add generic msi irq domain support")
Signed-off-by: default avatarJinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/20241026063639.10711-1-ruanjinjie@huawei.com


Signed-off-by: default avatarLin Yujun <linyujun809@huawei.com>
parent 0b8f0d9d

kernel/irq/msi.c

+1 −1
Original line number Diff line number Diff line
@@ -156,7 +156,7 @@ static int msi_domain_alloc(struct irq_domain *domain, unsigned int virq, 
		ret = ops->msi_init(domain, info, virq + i, hwirq + i, arg);

		if (ret < 0) {

			if (ops->msi_free) {

				for (i--; i > 0; i--)

				for (i--; i >= 0; i--)

					ops->msi_free(domain, info, virq + i);

			}

			irq_domain_free_irqs_top(domain, virq, nr_irqs);