[tip: irq/msi] PCI/MSI: Initialize MSI-X descriptors in the setup loop

[tip-bot2 for Li RongQing]

The following commit has been merged into the irq/msi branch of tip:

Commit-ID:     3f16c006f1f6aac0d99a85b387f0685fd1bb3a4d
Gitweb:        https://git.kernel.org/tip/3f16c006f1f6aac0d99a85b387f0685fd1bb3a4d
Author:        Li RongQing <lirongqing@xxxxxxxxx>
AuthorDate:    Mon, 09 Nov 2026 11:14:11 +08:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Mon, 09 Nov 2026 14:53:18 +01:00

PCI/MSI: Initialize MSI-X descriptors in the setup loop

msix_setup_msi_descs() uses a single on stack MSI descriptor for all MSI-X
entries.

Since msix_prepare_msi_desc() only sets can_mask for non-virtual
descriptors, a virtual descriptor can inherit can_mask == 1 from the
preceding real descriptor.

As msi_domain_insert_msi_desc() copies the descriptor, this stale value can
cause pci_msix_write_vector_ctrl() to access beyond the mapped MSI-X table.

Clear the descriptor inside the loop to ensure each MSI-X entry starts with
can_mask == 0.

[ tglx: Move declaration into the loop ]

Fixes: 3ece3e8e5976 ("PCI/MSI: Handle the NOMASK flag correctly for all PCI/MSI backends")
Signed-off-by: Li RongQing <lirongqing@xxxxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Link: https://patch.msgid.link/20261109031411.2205-1-lirongqing@xxxxxxxxx
---
 drivers/pci/msi/msi.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
index 8a0133a..4e8ec8d 100644
--- a/drivers/pci/msi/msi.c
+++ b/drivers/pci/msi/msi.c
@@ -636,11 +636,10 @@ static int msix_setup_msi_descs(struct pci_dev *dev, struct msix_entry *entries,
 {
 	int ret = 0, i, vec_count = pci_msix_vec_count(dev);
 	struct irq_affinity_desc *curmsk;
-	struct msi_desc desc;
-
-	memset(&desc, 0, sizeof(desc));
 
 	for (i = 0, curmsk = masks; i < nvec; i++, curmsk++) {
+		struct msi_desc desc = { };
+
 		desc.msi_index = entries ? entries[i].entry : i;
 		desc.affinity = masks ? curmsk : NULL;
 		desc.pci.msi_attrib.is_virtual = desc.msi_index >= vec_count;