[PATCH v5 7/8] PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc

[Koichiro Den]

pci_epf_alloc_doorbell() stores the allocated doorbell message array in
epf->db_msg/epf->num_db before requesting MSI vectors. If MSI allocation
fails, the array is freed but the EPF state may still point to freed
memory.

Clear epf->db_msg and epf->num_db on the MSI allocation failure path so
that later cleanup cannot double-free the array and callers can retry
allocation.

Also return -EBUSY when doorbells have already been allocated to prevent
leaking or overwriting an existing allocation.

Fixes: 1c3b002c6bf6 ("PCI: endpoint: Add RC-to-EP doorbell support using 
platform MSI controller")
Signed-off-by: Koichiro Den <d...@valinux.co.jp>
---
 drivers/pci/endpoint/pci-ep-msi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/pci/endpoint/pci-ep-msi.c 
b/drivers/pci/endpoint/pci-ep-msi.c
index 1b58357b905f..ad8a81d6ad77 100644
--- a/drivers/pci/endpoint/pci-ep-msi.c
+++ b/drivers/pci/endpoint/pci-ep-msi.c
@@ -50,6 +50,9 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
                return -EINVAL;
        }
 
+       if (epf->db_msg)
+               return -EBUSY;
+
        domain = of_msi_map_get_device_domain(epc->dev.parent, 0,
                                              DOMAIN_BUS_PLATFORM_MSI);
        if (!domain) {
@@ -79,6 +82,8 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
        if (ret) {
                dev_err(dev, "Failed to allocate MSI\n");
                kfree(msg);
+               epf->db_msg = NULL;
+               epf->num_db = 0;
                return ret;
        }
 
-- 
2.51.0