[PATCH 0/3] perf: Remove redundant error messages on IRQ request failure

[PATCH 0/3] perf: Remove redundant error messages on IRQ request failure

[Pan Chuang]

devm_request_threaded_irq() and devm_request_any_context_irq()
automatically log detailed error messages on failure via
the devm_request_result() helper, which prints device
name, IRQ number, handler functions, and error code.

Since devm_request_irq() is a static inline wrapper around
devm_request_threaded_irq(), it also benefits from this
automatic logging.

Remove the now-redundant dev_err() and dev_err_probe() calls
in perf drivers that follow these devm_request_*_irq()
functions, as the core now provides more detailed diagnostic
information on failure.

Pan Chuang (3):
  perf: Remove redundant dev_err()/dev_err_probe()
  perf: arm_cspmu: Remove redundant dev_err()
  drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe()

 drivers/perf/alibaba_uncore_drw_pmu.c        | 5 +----
 drivers/perf/arm_cspmu/arm_cspmu.c           | 4 +---
 drivers/perf/fsl_imx8_ddr_perf.c             | 4 +---
 drivers/perf/fsl_imx9_ddr_perf.c             | 4 +---
 drivers/perf/fujitsu_uncore_pmu.c            | 2 +-
 drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 3 +--
 drivers/perf/hisilicon/hisi_uncore_pmu.c     | 5 +----
 drivers/perf/qcom_l2_pmu.c                   | 5 +----
 drivers/perf/qcom_l3_pmu.c                   | 5 +----
 drivers/perf/starfive_starlink_pmu.c         | 2 +-
 drivers/perf/xgene_pmu.c                     | 4 +---
 11 files changed, 11 insertions(+), 32 deletions(-)

-- 
2.34.1

[PATCH 1/3] perf: Remove redundant dev_err()/dev_err_probe()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() and dev_err_probe() calls.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/perf/alibaba_uncore_drw_pmu.c | 5 +----
 drivers/perf/fsl_imx8_ddr_perf.c      | 4 +---
 drivers/perf/fsl_imx9_ddr_perf.c      | 4 +---
 drivers/perf/fujitsu_uncore_pmu.c     | 2 +-
 drivers/perf/qcom_l2_pmu.c            | 5 +----
 drivers/perf/qcom_l3_pmu.c            | 5 +----
 drivers/perf/starfive_starlink_pmu.c  | 2 +-
 drivers/perf/xgene_pmu.c              | 4 +---
 8 files changed, 8 insertions(+), 23 deletions(-)

diff --git a/drivers/perf/alibaba_uncore_drw_pmu.c b/drivers/perf/alibaba_uncore_drw_pmu.c
index 74786a5dd6a2..fc934bccf4a6 100644
--- a/drivers/perf/alibaba_uncore_drw_pmu.c
+++ b/drivers/perf/alibaba_uncore_drw_pmu.c
@@ -449,11 +449,8 @@ static struct ali_drw_pmu_irq *__ali_drw_pmu_init_irq(struct platform_device
 	 */
 	ret = devm_request_irq(&pdev->dev, irq_num, ali_drw_pmu_isr,
 			       IRQF_SHARED, dev_name(&pdev->dev), irq);
-	if (ret < 0) {
-		dev_err(&pdev->dev,
-			"Fail to request IRQ:%d ret:%d\n", irq_num, ret);
+	if (ret < 0)
 		goto out_free;
-	}
 
 	ret = irq_set_affinity_hint(irq_num, cpumask_of(irq->cpu));
 	if (ret)
diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
index 3760ebe02674..dd8046265584 100644
--- a/drivers/perf/fsl_imx8_ddr_perf.c
+++ b/drivers/perf/fsl_imx8_ddr_perf.c
@@ -858,10 +858,8 @@ static int ddr_perf_probe(struct platform_device *pdev)
 					IRQF_NOBALANCING | IRQF_NO_THREAD,
 					DDR_CPUHP_CB_NAME,
 					pmu);
-	if (ret < 0) {
-		dev_err(&pdev->dev, "Request irq failed: %d", ret);
+	if (ret < 0)
 		goto ddr_perf_err;
-	}
 
 	pmu->irq = irq;
 	ret = irq_set_affinity(pmu->irq, cpumask_of(pmu->cpu));
diff --git a/drivers/perf/fsl_imx9_ddr_perf.c b/drivers/perf/fsl_imx9_ddr_perf.c
index 6fee5eb5087a..d59bc5ea3155 100644
--- a/drivers/perf/fsl_imx9_ddr_perf.c
+++ b/drivers/perf/fsl_imx9_ddr_perf.c
@@ -830,10 +830,8 @@ static int ddr_perf_probe(struct platform_device *pdev)
 	ret = devm_request_irq(&pdev->dev, irq, ddr_perf_irq_handler,
 			       IRQF_NOBALANCING | IRQF_NO_THREAD,
 			       DDR_CPUHP_CB_NAME, pmu);
-	if (ret < 0) {
-		dev_err(&pdev->dev, "Request irq failed: %d", ret);
+	if (ret < 0)
 		goto ddr_perf_err;
-	}
 
 	pmu->irq = irq;
 	ret = irq_set_affinity(pmu->irq, cpumask_of(pmu->cpu));
diff --git a/drivers/perf/fujitsu_uncore_pmu.c b/drivers/perf/fujitsu_uncore_pmu.c
index ede652f757da..fa64146fcac6 100644
--- a/drivers/perf/fujitsu_uncore_pmu.c
+++ b/drivers/perf/fujitsu_uncore_pmu.c
@@ -526,7 +526,7 @@ static int fujitsu_uncore_pmu_probe(struct platform_device *pdev)
 			       IRQF_NOBALANCING | IRQF_NO_THREAD,
 			       name, uncorepmu);
 	if (ret)
-		return dev_err_probe(dev, ret, "Failed to request IRQ:%d\n", irq);
+		return ret;
 
 	ret = irq_set_affinity(irq, cpumask_of(uncorepmu->cpu));
 	if (ret)
diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c
index c0c522b10b72..29554cca22c5 100644
--- a/drivers/perf/qcom_l2_pmu.c
+++ b/drivers/perf/qcom_l2_pmu.c
@@ -869,11 +869,8 @@ static int l2_cache_pmu_probe_cluster(struct device *dev, void *data)
 			       IRQF_NOBALANCING | IRQF_NO_THREAD |
 			       IRQF_NO_AUTOEN,
 			       "l2-cache-pmu", cluster);
-	if (err) {
-		dev_err(&pdev->dev,
-			"Unable to request IRQ%d for L2 PMU counters\n", irq);
+	if (err)
 		return err;
-	}
 
 	dev_info(&pdev->dev,
 		 "Registered L2 cache PMU cluster %lld\n", fw_cluster_id);
diff --git a/drivers/perf/qcom_l3_pmu.c b/drivers/perf/qcom_l3_pmu.c
index c8d259dd1f80..e18d0f94e8d8 100644
--- a/drivers/perf/qcom_l3_pmu.c
+++ b/drivers/perf/qcom_l3_pmu.c
@@ -767,11 +767,8 @@ static int qcom_l3_cache_pmu_probe(struct platform_device *pdev)
 
 	ret = devm_request_irq(&pdev->dev, ret, qcom_l3_cache__handle_irq, 0,
 			       name, l3pmu);
-	if (ret) {
-		dev_err(&pdev->dev, "Request for IRQ failed for slice @%pa\n",
-			&memrc->start);
+	if (ret)
 		return ret;
-	}
 
 	/* Add this instance to the list used by the offline callback */
 	ret = cpuhp_state_add_instance(CPUHP_AP_PERF_ARM_QCOM_L3_ONLINE, &l3pmu->node);
diff --git a/drivers/perf/starfive_starlink_pmu.c b/drivers/perf/starfive_starlink_pmu.c
index dc4e653761fc..98e5ccee2fdc 100644
--- a/drivers/perf/starfive_starlink_pmu.c
+++ b/drivers/perf/starfive_starlink_pmu.c
@@ -435,7 +435,7 @@ static int starlink_setup_irqs(struct starlink_pmu *starlink_pmu,
 	ret = devm_request_irq(&pdev->dev, irq, starlink_pmu_handle_irq,
 			       0, STARLINK_PMU_PDEV_NAME, starlink_pmu);
 	if (ret)
-		return dev_err_probe(&pdev->dev, ret, "Failed to request IRQ\n");
+		return ret;
 
 	starlink_pmu->irq = irq;
 
diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
index e9e4871db08d..ab3623fab914 100644
--- a/drivers/perf/xgene_pmu.c
+++ b/drivers/perf/xgene_pmu.c
@@ -1876,10 +1876,8 @@ static int xgene_pmu_probe(struct platform_device *pdev)
 	rc = devm_request_irq(&pdev->dev, irq, xgene_pmu_isr,
 				IRQF_NOBALANCING | IRQF_NO_THREAD,
 				dev_name(&pdev->dev), xgene_pmu);
-	if (rc) {
-		dev_err(&pdev->dev, "Could not request IRQ %d\n", irq);
+	if (rc)
 		return rc;
-	}
 
 	xgene_pmu->irq = irq;
 
-- 
2.34.1

Re: [PATCH 1/3] perf: Remove redundant dev_err()/dev_err_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [Low] The `memrc` variable is no longer used after the removal of the `dev_err()` call, leaving an unused local variable.

Pre-existing issues:
- [High] The IRQ handler context is freed via kfree() before the devm_request_irq() resource is released, creating a use-after-free vulnerability.
- [High] Missing cleanup of CPU hotplug instance registration when perf_pmu_register() fails, leaving a freed pointer in the global hotplug list.
--

--- Patch [1]: [PATCH 1/3] perf: Remove redundant dev_err()/dev_err_probe() ---
commit 83d88878cd6553e7af185d501c3dfdb2c01816e8
Author: Pan Chuang <panchuang@vivo.com>

perf: Remove redundant dev_err()/dev_err_probe()

Since commit 55b48e23f5c4, devm_request_irq() automatically logs
detailed error messages on failure. This patch removes the now-redundant
driver-specific dev_err() and dev_err_probe() calls.

> diff --git a/drivers/perf/alibaba_uncore_drw_pmu.c b/drivers/perf/alibaba_uncore_drw_pmu.c
> index 74786a5dd6a23..fc934bccf4a64 100644
> --- a/drivers/perf/alibaba_uncore_drw_pmu.c
> +++ b/drivers/perf/alibaba_uncore_drw_pmu.c
> @@ -449,11 +449,8 @@ static struct ali_drw_pmu_irq *__ali_drw_pmu_init_irq(struct platform_device
>  	 */
>  	ret = devm_request_irq(&pdev->dev, irq_num, ali_drw_pmu_isr,
>  			       IRQF_SHARED, dev_name(&pdev->dev), irq);
> -	if (ret < 0) {
> -		dev_err(&pdev->dev,
> -			"Fail to request IRQ:%d ret:%d\n", irq_num, ret);
> +	if (ret < 0)
>  		goto out_free;

[Severity: High]
This is a pre-existing issue, but since we are modifying the error path
here, can this lead to a use-after-free if a subsequent step fails?

In __ali_drw_pmu_init_irq(), if devm_request_irq() succeeds but a later
function like irq_set_affinity_hint() fails, the code jumps to out_free:

out_free:
        kfree(irq);
        return ERR_PTR(ret);

Since devm_request_irq() uses the IRQF_SHARED flag, another device sharing
this IRQ could trigger an interrupt immediately. If ali_drw_pmu_isr()
executes before the devres cleanup deregisters the handler, will it
dereference the already freed irq pointer?

> -	}
>  
>  	ret = irq_set_affinity_hint(irq_num, cpumask_of(irq->cpu));
>  	if (ret)

[ ... ]

> diff --git a/drivers/perf/qcom_l3_pmu.c b/drivers/perf/qcom_l3_pmu.c
> index c8d259dd1f807..e18d0f94e8d86 100644
> --- a/drivers/perf/qcom_l3_pmu.c
> +++ b/drivers/perf/qcom_l3_pmu.c
> @@ -767,11 +767,8 @@ static int qcom_l3_cache_pmu_probe(struct platform_device *pdev)
>  
>  	ret = devm_request_irq(&pdev->dev, ret, qcom_l3_cache__handle_irq, 0,
>  			       name, l3pmu);
> -	if (ret) {
> -		dev_err(&pdev->dev, "Request for IRQ failed for slice @%pa\n",
> -			&memrc->start);
> +	if (ret)
>  		return ret;

[Severity: Low]
The patch removes the dev_err() call which was the only reader of the
memrc variable in qcom_l3_cache_pmu_probe(). Does this leave memrc
populated but entirely unused?

Could the code be cleaned up to use devm_platform_ioremap_resource() 
instead of devm_platform_get_and_ioremap_resource() and remove memrc 
completely?

> -	}
>  
>  	/* Add this instance to the list used by the offline callback */
>  	ret = cpuhp_state_add_instance(CPUHP_AP_PERF_ARM_QCOM_L3_ONLINE, &l3pmu->node);

[Severity: High]
This isn't a bug introduced by this patch, but does this function leak the
CPU hotplug instance if perf_pmu_register() fails later in the probe?

qcom_l3_cache_pmu_probe() registers the instance here:

    ret = cpuhp_state_add_instance(CPUHP_AP_PERF_ARM_QCOM_L3_ONLINE,
                                   &l3pmu->node);

But if perf_pmu_register() fails right after, it returns immediately:

    ret = perf_pmu_register(&l3pmu->pmu, name, -1);
    if (ret < 0) {
        dev_err(&pdev->dev, "Failed to register L3 cache PMU (%d)\n", ret);
        return ret;
    }

Since devres will automatically free the l3pmu struct on probe failure,
will the freed l3pmu->node remain linked in the global list and cause a
use-after-free during subsequent CPU hotplug events?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717103123.34887-1-panchuang@vivo.com?part=1

Re: [PATCH 1/3] perf: Remove redundant dev_err()/dev_err_probe()

[Xu Yang]

On Fri, Jul 17, 2026 at 06:31:17PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() and dev_err_probe() calls.
> 
> Signed-off-by: Pan Chuang <panchuang@vivo.com>
> ---
>  drivers/perf/alibaba_uncore_drw_pmu.c | 5 +----
>  drivers/perf/fsl_imx8_ddr_perf.c      | 4 +---
>  drivers/perf/fsl_imx9_ddr_perf.c      | 4 +---
>  drivers/perf/fujitsu_uncore_pmu.c     | 2 +-
>  drivers/perf/qcom_l2_pmu.c            | 5 +----
>  drivers/perf/qcom_l3_pmu.c            | 5 +----
>  drivers/perf/starfive_starlink_pmu.c  | 2 +-
>  drivers/perf/xgene_pmu.c              | 4 +---
>  8 files changed, 8 insertions(+), 23 deletions(-)
> 
> diff --git a/drivers/perf/alibaba_uncore_drw_pmu.c b/drivers/perf/alibaba_uncore_drw_pmu.c
> index 74786a5dd6a2..fc934bccf4a6 100644
> --- a/drivers/perf/alibaba_uncore_drw_pmu.c
> +++ b/drivers/perf/alibaba_uncore_drw_pmu.c
> @@ -449,11 +449,8 @@ static struct ali_drw_pmu_irq *__ali_drw_pmu_init_irq(struct platform_device
>  	 */
>  	ret = devm_request_irq(&pdev->dev, irq_num, ali_drw_pmu_isr,
>  			       IRQF_SHARED, dev_name(&pdev->dev), irq);
> -	if (ret < 0) {
> -		dev_err(&pdev->dev,
> -			"Fail to request IRQ:%d ret:%d\n", irq_num, ret);
> +	if (ret < 0)
>  		goto out_free;
> -	}
>  
>  	ret = irq_set_affinity_hint(irq_num, cpumask_of(irq->cpu));
>  	if (ret)
> diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
> index 3760ebe02674..dd8046265584 100644
> --- a/drivers/perf/fsl_imx8_ddr_perf.c
> +++ b/drivers/perf/fsl_imx8_ddr_perf.c
> @@ -858,10 +858,8 @@ static int ddr_perf_probe(struct platform_device *pdev)
>  					IRQF_NOBALANCING | IRQF_NO_THREAD,
>  					DDR_CPUHP_CB_NAME,
>  					pmu);
> -	if (ret < 0) {
> -		dev_err(&pdev->dev, "Request irq failed: %d", ret);
> +	if (ret < 0)
>  		goto ddr_perf_err;
> -	}
>  
>  	pmu->irq = irq;
>  	ret = irq_set_affinity(pmu->irq, cpumask_of(pmu->cpu));
> diff --git a/drivers/perf/fsl_imx9_ddr_perf.c b/drivers/perf/fsl_imx9_ddr_perf.c
> index 6fee5eb5087a..d59bc5ea3155 100644
> --- a/drivers/perf/fsl_imx9_ddr_perf.c
> +++ b/drivers/perf/fsl_imx9_ddr_perf.c
> @@ -830,10 +830,8 @@ static int ddr_perf_probe(struct platform_device *pdev)
>  	ret = devm_request_irq(&pdev->dev, irq, ddr_perf_irq_handler,
>  			       IRQF_NOBALANCING | IRQF_NO_THREAD,
>  			       DDR_CPUHP_CB_NAME, pmu);
> -	if (ret < 0) {
> -		dev_err(&pdev->dev, "Request irq failed: %d", ret);
> +	if (ret < 0)
>  		goto ddr_perf_err;
> -	}
>  
>  	pmu->irq = irq;
>  	ret = irq_set_affinity(pmu->irq, cpumask_of(pmu->cpu));

Reviewed-by: Xu Yang <xu.yang_2@nxp.com>

Thanks,
Xu Yang

Re: [PATCH 1/3] perf: Remove redundant dev_err()/dev_err_probe()

[Frank Li]

On Fri, Jul 17, 2026 at 06:31:17PM +0800, Pan Chuang wrote:
> Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
> devm_request_*_irq()"), devm_request_irq() automatically logs
> detailed error messages on failure. Remove the now-redundant
> driver-specific dev_err() and dev_err_probe() calls.
>
> Signed-off-by: Pan Chuang <panchuang@vivo.com>
> ---
>  drivers/perf/alibaba_uncore_drw_pmu.c | 5 +----
>  drivers/perf/fsl_imx8_ddr_perf.c      | 4 +---
>  drivers/perf/fsl_imx9_ddr_perf.c      | 4 +---

for imx part

Acked-by: Frank Li <Frank.Li@kernel.org>

[PATCH 2/3] perf: arm_cspmu: Remove redundant dev_err()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/perf/arm_cspmu/arm_cspmu.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/perf/arm_cspmu/arm_cspmu.c b/drivers/perf/arm_cspmu/arm_cspmu.c
index e6292021f653..ae754363fba8 100644
--- a/drivers/perf/arm_cspmu/arm_cspmu.c
+++ b/drivers/perf/arm_cspmu/arm_cspmu.c
@@ -1070,10 +1070,8 @@ static int arm_cspmu_request_irq(struct arm_cspmu *cspmu)
 	ret = devm_request_irq(dev, irq, arm_cspmu_handle_irq,
 			       IRQF_NOBALANCING | IRQF_NO_THREAD, dev_name(dev),
 			       cspmu);
-	if (ret) {
-		dev_err(dev, "Could not request IRQ %d\n", irq);
+	if (ret)
 		return ret;
-	}
 
 	cspmu->irq = irq;
 
-- 
2.34.1

[PATCH 3/3] drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe()

[Pan Chuang]

Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() and dev_err_probe() calls.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
---
 drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 3 +--
 drivers/perf/hisilicon/hisi_uncore_pmu.c     | 5 +----
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
index f963e4f9e552..56a88fb0d3c2 100644
--- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
@@ -604,8 +604,7 @@ static int hisi_l3c_pmu_init_ext(struct hisi_pmu *l3c_pmu, struct platform_devic
 				       IRQF_NOBALANCING | IRQF_NO_THREAD,
 				       irqname, l3c_pmu);
 		if (ret < 0)
-			return dev_err_probe(&pdev->dev, ret,
-				"Fail to request EXT IRQ: %d.\n", irq);
+			return ret;
 
 		hisi_l3c_pmu->ext_irq[i] = irq;
 	}
diff --git a/drivers/perf/hisilicon/hisi_uncore_pmu.c b/drivers/perf/hisilicon/hisi_uncore_pmu.c
index 0ff2fdf4b3e2..77390d033d08 100644
--- a/drivers/perf/hisilicon/hisi_uncore_pmu.c
+++ b/drivers/perf/hisilicon/hisi_uncore_pmu.c
@@ -192,11 +192,8 @@ int hisi_uncore_pmu_init_irq(struct hisi_pmu *hisi_pmu,
 	ret = devm_request_irq(&pdev->dev, irq, hisi_uncore_pmu_isr,
 			       IRQF_NOBALANCING | IRQF_NO_THREAD,
 			       dev_name(&pdev->dev), hisi_pmu);
-	if (ret < 0) {
-		dev_err(&pdev->dev,
-			"Fail to request IRQ: %d ret: %d.\n", irq, ret);
+	if (ret < 0)
 		return ret;
-	}
 
 	hisi_pmu->irq = irq;
 
-- 
2.34.1

Re: [PATCH 3/3] drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds array access / buffer overflow in hisi_l3c_pmu_init_ext() due to missing upper bound check on device tree IRQ count.
--

--- Patch [3]: [PATCH 3/3] drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe() ---
commit 439e35f073703c68b0687dec637faec43876da5e
Author: Pan Chuang <panchuang@vivo.com>

drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe()

This commit removes redundant driver-specific error logs when calling
devm_request_irq(). The core framework automatically handles the error
reporting on failure.

> diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
> index f963e4f9e5527..56a88fb0d3c2c 100644
> --- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
> +++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
> @@ -604,8 +604,7 @@ static int hisi_l3c_pmu_init_ext(struct hisi_pmu *l3c_pmu, struct platform_devic
>  				       IRQF_NOBALANCING | IRQF_NO_THREAD,
>  				       irqname, l3c_pmu);
>  		if (ret < 0)
> -			return dev_err_probe(&pdev->dev, ret,
> -				"Fail to request EXT IRQ: %d.\n", irq);
> +			return ret;
>  
>  		hisi_l3c_pmu->ext_irq[i] = irq;

[Severity: High]
This is a pre-existing issue, but does this loop risk writing out of bounds
if the device tree specifies more IRQs than expected?

In hisi_l3c_pmu_init_ext(), the total number of IRQs is fetched with
platform_irq_count(pdev). The code enforces a lower bound but misses an
upper bound check:

    ext_num = platform_irq_count(pdev);
    if (ext_num < L3C_MAX_EXT)
        return -ENODEV;
    hisi_l3c_pmu->ext_num = ext_num - 1;

If a misconfigured device tree provides more IRQs than expected,
hisi_l3c_pmu->ext_num can exceed the fixed size of the ext_base and ext_irq
arrays, which are bound by L3C_MAX_EXT.

The loop iterating up to hisi_l3c_pmu->ext_num would then write out of
bounds into the ext_irq array at the end of this block.

Could we add an upper bound check for ext_num to prevent memory corruption
if too many IRQs are present?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717103123.34887-1-panchuang@vivo.com?part=3