Re: [PATCH v5 3/4] PCI: rzg3s-host: Prepare System Controller handling for multiple controllers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Failure to clear chained IRQ handlers in the error path leads to a Use-After-Free of the `host` structure.
--

commit 9d15bfaf7ab0514922ec90d6892801c1f1eeb157
Author: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

PCI: rzg3s-host: Prepare System Controller handling for multiple controllers

This commit prepares the RZ/G3S PCIe driver to support multiple PCIe
controllers by extending the System Controller (SYSC) information storage.
It introduces an array of sysc_info structures indexed by a new controller
ID field. Existing single-controller SoCs remain functionally unchanged.

> diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
> index cca2617f29157..03d79e98c9c99 100644
> --- a/drivers/pci/controller/pcie-rzg3s-host.c
> +++ b/drivers/pci/controller/pcie-rzg3s-host.c
[ ... ]
> @@ -1699,7 +1713,7 @@ static int rzg3s_pcie_probe(struct platform_device *pdev)
>  		return -ENOMEM;
>  
>  	sysc = host->sysc;
> -	sysc->info = &host->data->sysc_info;
> +	sysc->info = &host->data->sysc_info[host->controller_id];

[Severity: High]
This is a pre-existing issue, but I noticed a potential memory safety concern
in the error handling path of rzg3s_pcie_probe().

If probe fails later and executes the error path, it calls
rzg3s_pcie_teardown_irqdomain(). Looking at rzg3s_pcie_teardown_irqdomain(),
it executes:

    irq_domain_remove(host->intx_domain);

However, it does not appear to clear the chained interrupt handlers.

Because the host structure is allocated via devm_pci_alloc_host_bridge(),
it will be automatically freed when the probe fails.

Could this leave a dangling pointer in the parent interrupt controller,
resulting in a use-after-free if the hardware triggers
rzg3s_pcie_intx_irq_handler() after the teardown?

>  
>  	host->axi = devm_platform_ioremap_resource(pdev, 0);
>  	if (IS_ERR(host->axi))

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629220932.861445-1-prabhakar.mahadev-lad.rj@bp.renesas.com?part=3