[PATCH 4/5] lib: utils/irqchip/imsic: Fail MSI programming on compose error

[Nick Hu]

If imsic_compose_msi_msg() fails, imsic_program_msi() only prints
an error and still passes the message to sbi_irqchip_write_msi().
Since the message is not initialized, the MSI controller may be
programmed with uninitialized stack data and end up writing MSIs
to an arbitrary address. Even if the child driver drops the message,
success is still reported, so sbi_irqchip_set_affinity() records a
hart_index that does not match the hardware.

Return the compose error so that the irqchip framework can roll back
the handler registration or keep the previous affinity. Also
zero-initialize the message so it is never passed on uninitialized.

Signed-off-by: Nick Hu <nick.hu at sifive.com>
---
 lib/utils/irqchip/imsic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/utils/irqchip/imsic.c b/lib/utils/irqchip/imsic.c
index f6da9f7e..708e6754 100644
--- a/lib/utils/irqchip/imsic.c
+++ b/lib/utils/irqchip/imsic.c
@@ -454,7 +454,7 @@ static int imsic_program_msi(struct sbi_irqchip_device *chip,
 		      u32 eiid, u32 hart_index)
 {
 	struct imsic_data *imsic;
-	struct sbi_irqchip_msi_msg msg;
+	struct sbi_irqchip_msi_msg msg = {0};
 	int rc;
 
 	if (!chip)
@@ -470,6 +470,7 @@ static int imsic_program_msi(struct sbi_irqchip_device *chip,
 				__func__,
 				(unsigned long)eiid,
 				(unsigned long)hart_index, rc);
+		return rc;
 	}
 
 	rc = sbi_irqchip_write_msi(chip, eiid, &msg);

-- 
2.43.7