powerpc/pseries/msi: Fix NULL pointer dereference at irq domain teardown

covanam · maddy-kerneldev · commit ef3e73a917ec · 2025-10-13T09:39:02.000+05:30
pseries_msi_ops_teardown() reads pci_dev* from msi_alloc_info_t. However, pseries_msi_ops_prepare() does not populate this structure, thus it is all zeros. Consequently, pseries_msi_ops_teardown() triggers a NULL pointer dereference crash. struct pci_dev is available in struct irq_domain. Read it there instead. Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Closes: https://lore.kernel.org/linuxppc-dev/878d7651-433a-46fe-a28b-1b7e893fcbe0@linux.ibm.com/ Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Signed-off-by: Nam Cao <namcao@linutronix.de> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20251010120307.3281720-1-namcao@linutronix.de
diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c
@@ -443,8 +443,7 @@ static int pseries_msi_ops_prepare(struct irq_domain *domain, struct device *dev
  */
 static void pseries_msi_ops_teardown(struct irq_domain *domain, msi_alloc_info_t *arg)
 {
-	struct msi_desc *desc = arg->desc;
-	struct pci_dev *pdev = msi_desc_to_pci_dev(desc);
+	struct pci_dev *pdev = to_pci_dev(domain->dev);
 
 	rtas_disable_msi(pdev);
 }

Original file line number	Diff line number	Diff line change
`@@ -443,8 +443,7 @@ static int pseries_msi_ops_prepare(struct irq_domain domain, struct device dev`
`443`	`443`	`*/`
`444`	`444`	`static void pseries_msi_ops_teardown(struct irq_domain domain, msi_alloc_info_t arg)`
`445`	`445`	`{`
`446`		`- struct msi_desc *desc = arg->desc;`
`447`		`- struct pci_dev *pdev = msi_desc_to_pci_dev(desc);`
	`446`	`+ struct pci_dev *pdev = to_pci_dev(domain->dev);`
`448`	`447`
`449`	`448`	`rtas_disable_msi(pdev);`
`450`	`449`	`}`