Re: [PATCH v4 v4] PCI: dwc: Add PCI ID for LECARC PCIe pmu

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] The commit message claims that spaces were replaced with a tab, but the patch actually uses spaces.

Pre-existing issues:
- [High] The `dwc_pcie_pmu` driver caches a pointer to the PCI device (`pdev`) in `pcie_pmu->pdev` but explicitly drops the reference count. If the PCI device is removed, this leads to a Use-After-Free when the PMU driver accesses `pdev`.
--

--- Patch [1]: [PATCH v4 v4] PCI: dwc: Add PCI ID for LECARC PCIe pmu ---
commit c7438edb93a79853b55beed10ead3c56dfcc3ff6
Author: Brett Zhou <brett_zhou@lecomputing.com>

PCI: dwc: Add PCI ID for LECARC PCIe pmu

This patch adds support for the PCIe PMU found on LECARC SoCs by adding
the PCI vendor ID to the vendor-specific capability list. This enables
the standard DWC RAS/DES feature detection.

Link to v3: https://patch.msgid.link/20260713-pcie-pmu-v3-1-5e4a8d82248d@lecomputing.com

> Changes in v2:
> - Format: repalce space with tab to separate the macro name and the value.

[Severity: Low]
This isn't a bug, but there is a typo (repalce) in the changelog text.

[ ... ]

> diff --git a/include/linux/pcie-dwc.h b/include/linux/pcie-dwc.h
> index 8ff778e7aec0e..0df5fa81b5610 100644
> --- a/include/linux/pcie-dwc.h
> +++ b/include/linux/pcie-dwc.h
> @@ -11,6 +11,8 @@
>  
>  #include <linux/pci_ids.h>
>  
> +#define PCI_VENDOR_ID_LECARC           0x0720

[Severity: Low]
This isn't a bug, but the v2 changelog claims spaces were replaced with a
tab, while this macro definition still uses 11 spaces.

[Severity: High]
This is a pre-existing issue, but enabling the LECARC vendor ID exposes these
platforms to a flaw in drivers/perf/dwc_pcie_pmu.c.

Does dwc_pcie_pmu_probe() trigger a use-after-free if the device is removed?

drivers/perf/dwc_pcie_pmu.c:dwc_pcie_pmu_probe() {
    ...
    pci_dev_put(pdev);
    ...
    pcie_pmu->pdev = pdev;
    ...
}

The driver retrieves the PCI device and increments its reference count, but
explicitly drops the reference with pci_dev_put() while retaining the pointer
in pcie_pmu->pdev.

If the device is hot-removed, the PCI core drops its reference and frees the
device structure. If a userspace process holds an open perf event and reads
from it, wouldn't callbacks like dwc_pcie_pmu_read_lane_event_counter()
dereference the freed pcie_pmu->pdev pointer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721-pcie-pmu-v4-1-850a4e695b19@lecomputing.com?part=1