[PATCH 4/5] lib: utils/irqchip/imsic: Fail MSI programming on compose error

[Pawandeep Oza]

On Sun, Nov 1, 2026 at 7:47 PM Nick Hu <nick.hu at sifive.com> wrote:
>
> If imsic_compose_msi_msg() fails, imsic_program_msi() only prints
> an error and still passes the message to sbi_irqchip_write_msi().
> Since the message is not initialized, the MSI controller may be
> programmed with uninitialized stack data and end up writing MSIs
> to an arbitrary address. Even if the child driver drops the message,
> success is still reported, so sbi_irqchip_set_affinity() records a
> hart_index that does not match the hardware.
>
> Return the compose error so that the irqchip framework can roll back
> the handler registration or keep the previous affinity. Also
> zero-initialize the message so it is never passed on uninitialized.
>
> Signed-off-by: Nick Hu <nick.hu at sifive.com>
> ---
>  lib/utils/irqchip/imsic.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/lib/utils/irqchip/imsic.c b/lib/utils/irqchip/imsic.c
> index f6da9f7e..708e6754 100644
> --- a/lib/utils/irqchip/imsic.c
> +++ b/lib/utils/irqchip/imsic.c
> @@ -454,7 +454,7 @@ static int imsic_program_msi(struct sbi_irqchip_device *chip,
>                       u32 eiid, u32 hart_index)
>  {
>         struct imsic_data *imsic;
> -       struct sbi_irqchip_msi_msg msg;
> +       struct sbi_irqchip_msi_msg msg = {0};
>         int rc;
>
>         if (!chip)
> @@ -470,6 +470,7 @@ static int imsic_program_msi(struct sbi_irqchip_device *chip,
>                                 __func__,
>                                 (unsigned long)eiid,
>                                 (unsigned long)hart_index, rc);
> +               return rc;
>         }
>
>         rc = sbi_irqchip_write_msi(chip, eiid, &msg);
>
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

Reviewed-by: Pawandeep Oza <pawandeep.oza at oss.qualcomm.com>