Re: [PATCH] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[Farhan Ali]

Hi Li,

On 11/8/2026 7:14 PM, lirongqing wrote:
> From: Li RongQing <lirongqing@xxxxxxxxx>
>
> msix_setup_msi_descs() reuses a single stack descriptor for all
> MSI-X entries.
>
> Since msix_prepare_msi_desc() only sets can_mask for non-virtual
> descriptors, a virtual descriptor can inherit can_mask == 1 from
> the preceding real descriptor.
>
> As msi_domain_insert_msi_desc() copies the descriptor, this stale
> value can cause pci_msix_write_vector_ctrl() to access beyond the
> mapped MSI-X table.
>
> Clear the descriptor inside the loop to ensure each MSI-X entry
> starts with can_mask == 0.
>
> Fixes: 3ece3e8e5976 ("PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends")
> Signed-off-by: Li RongQing <lirongqing@xxxxxxxxx>

I think at some point the can_mask attribute was set in the loop in 
msix_setup_msi_descs(). But this was split with commit 612ad43330d9 
("PCI/MSI: Split MSI-X descriptor setup"), so I think the Fixes tag 
should be applied against that commit?


> ---
>   drivers/pci/msi/msi.c | 3 +--
>   1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
> index a346284..681dd2f 100644
> --- a/drivers/pci/msi/msi.c
> +++ b/drivers/pci/msi/msi.c
> @@ -638,9 +638,8 @@ static int msix_setup_msi_descs(struct pci_dev *dev, struct msix_entry *entries,
>   	struct irq_affinity_desc *curmsk;
>   	struct msi_desc desc;
>   
> -	memset(&desc, 0, sizeof(desc));
> -
>   	for (i = 0, curmsk = masks; i < nvec; i++, curmsk++) {
> +		memset(&desc, 0, sizeof(desc));

I wonder if we can just set can_mask = 0 in the loop rather doing the 
memset every iteration?

Thanks

Farhan

>   		desc.msi_index = entries ? entries[i].entry : i;
>   		desc.affinity = masks ? curmsk : NULL;
>   		desc.pci.msi_attrib.is_virtual = desc.msi_index >= vec_count;