Linux Kernel PCI-DWC EP: Fix for unflushed MSI writes before IATU unmap

Vulnerability Summary Vulnerability Overview Vulnerability Type: PCI: dwc: ep: Flush cached MSI writes before unmapping IATU Problem Description: When the PCI device path unmapping occurs before the IATU mapping is unmapped, cached MSI writes may be lost. This issue is triggered in , where MSI writes that are not flushed prior to unmapping may result in the loss of MSI writes. Fix Method: Flush cached MSI writes before unmapping the IATU to ensure the writes are completed before the unmap operation. Scope of Impact Affected Modules: and Impact Scenario: Cached MSI writes may be lost if the PCI device path unmaps before the IATU mapping is unmapped. Fix Solution Fix Commit: Fix Details: In , flush cached MSI writes before unmapping the IATU. POC/Exploit Code ```c // Pre-fix code (dwc-pcie-designware-ep.c) static void dwc_pcie_ep_unmap(struct dwc_pcie_ep ep, u8 func_no, u16 tag, u64 addr, u32 len) { struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...; struct dwc_pcie_ep ep = ...;

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel PCI-DWC EP: Fix for unflushed MSI writes before IATU unmap