On Mon, Feb 09, 2026 at 09:53:15PM +0900, Koichiro Den wrote:
> pci_epf_alloc_doorbell() stores the allocated doorbell message array in
> epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation
> fails, the array is freed but the EPF state may still point to freed
> memory.
>
> Clear epf->db_msg and epf->num_db on the MSI allocation failure path so
> that later cleanup cannot double-free the array and callers can retry
> allocation.
>
> Also return -EBUSY when doorbells have already been allocated to prevent
> leaking or overwriting an existing allocation.
>
> Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using
> platform MSI controller")
> Signed-off-by: Koichiro Den <[email protected]>
> ---
Thanks, fix patch should be first.
Reviewed-by: Frank Li <[email protected]>
Frank
> drivers/pci/endpoint/pci-ep-msi.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/pci/endpoint/pci-ep-msi.c
> b/drivers/pci/endpoint/pci-ep-msi.c
> index 1b58357b905f..ad8a81d6ad77 100644
> --- a/drivers/pci/endpoint/pci-ep-msi.c
> +++ b/drivers/pci/endpoint/pci-ep-msi.c
> @@ -50,6 +50,9 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> return -EINVAL;
> }
>
> + if (epf->db_msg)
> + return -EBUSY;
> +
> domain = of_msi_map_get_device_domain(epc->dev.parent, 0,
> DOMAIN_BUS_PLATFORM_MSI);
> if (!domain) {
> @@ -79,6 +82,8 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> if (ret) {
> dev_err(dev, "Failed to allocate MSI\n");
> kfree(msg);
> + epf->db_msg = NULL;
> + epf->num_db = 0;
> return ret;
> }
>
> --
> 2.51.0
>
