[PATCH] PCI: brcmstb: Reserve only the MSI vectors that are handed out

[Thomas Gleixner]

On Fri, Oct 30 2026 at 21:59, Han wrote:
> On Thu, Oct 01 2026 at 21:29, Thomas Gleixner wrote:
>   The buggy address is located 0 bytes to the right of
>    allocated 48-byte region [ffff8000053a6880, ffff8000053a68b0)
>
> The report is caused by the patch. __msi_domain_alloc_irqs() passes
> nvec_aligned (4) to __irq_domain_alloc_irqs() together with
> desc->affinity, which has only nvec_used (3) entries. alloc_descs()
> then reads all 4 entries. The fourth entry is read past the end of
> the array. If the data there has no CPU set, the allocation fails
> with -ENOSPC. Without PCI_IRQ_AFFINITY, desc->affinity is NULL, so
> this read does not happen.

Ah. I missed that detail. I'll look at it on Monday.