Re: [PATCH v1] genirq/msi: fix crash when handling Multi-MSI

[Marc Zyngier]

Please avoid top-posting.

On Mon, 17 Jan 2022 10:10:13 +0000,
Tong Zhang <ztong0001@xxxxxxxxx> wrote:
> 
> Hello,
> 
> ops->msi_check could point to pci_msi_domain_check_cap that is the
> function in question
> 
> hence we can have following call stack
> 
> pci_msi_domain_check_cap (used by ops->msi_check(domain, info, dev))
> msi_domain_prepare_irqs
> __msi_domain_alloc_irqs
> msi_domain_alloc_irqs_descs_locked
> 
> What I am suggesting is commit 0f62d941acf9 changed how this return
> value is being handled and created a UAF

OK, this makes more sense.

But msi_domain_prepare_irqs() shouldn't fail in this case, and we
should proceed with the allocation of at least one vector, which isn't
happening here.

Also, if __msi_domain_alloc_irqs() is supposed to return the number of
irqs allocated, it isn't doing it consistently.

Thomas, can you shed some light on what is the intended behaviour
here?

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.