From: sashiko-bot@kernel.org
To: "Gary Guo" <gary@garyguo.net>
Cc: dri-devel@lists.freedesktop.org, dlemoal@kernel.org,
linux-pci@vger.kernel.org, cassel@kernel.org,
linux-scsi@vger.kernel.org, linux-ide@vger.kernel.org
Subject: Re: [PATCH v4 3/9] ipack: tpci200: don't store pci_device_id
Date: Fri, 24 Jul 2026 22:02:02 +0000 [thread overview]
Message-ID: <20260724220202.731C51F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260723-pci_id_fix-v4-3-3580726844e1@garyguo.net>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] MMIO configuration registers are mapped and accessed before calling pci_enable_device(), which can lead to dropped writes or master aborts.
--
--- Patch [3]: [PATCH v4 3/9] ipack: tpci200: don't store pci_device_id ---
commit eed0a798b7390c20259769af7ca3dfe410d112f0
Author: Gary Guo <gary@garyguo.net>
Subject: ipack: tpci200: don't store pci_device_id
This commit removes the stored pci_device_id from the tpci200_infos structure.
Since dynamic IDs are not guaranteed to outlive the probe function, and the
stored ID is unused, removing it prevents potential issues.
> diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c
> index 05dcb6675cd66..1cf51f7632932 100644
> --- a/drivers/ipack/carriers/tpci200.c
> +++ b/drivers/ipack/carriers/tpci200.c
> @@ -562,7 +562,6 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
>
> /* Save struct pci_dev pointer */
> tpci200->info->pdev = pdev;
> - tpci200->info->id_table = (struct pci_device_id *)id;
>
> /* register the device and initialize it */
> ret = tpci200_install(tpci200);
[Severity: High]
This is a pre-existing issue, but I noticed that MMIO configuration registers
are mapped and accessed before pci_enable_device() is called.
Earlier in tpci200_pci_probe(), the driver maps the configuration memory bar
and immediately accesses the registers to configure byte swapping:
reg32 = ioread32(tpci200->info->cfg_regs + LAS1_DESC);
reg32 |= 1 << LAS_BIT_BIGENDIAN;
iowrite32(reg32, tpci200->info->cfg_regs + LAS1_DESC);
However, pci_enable_device() doesn't seem to be called until later in the
probe sequence, when tpci200_install() eventually calls tpci200_register():
if (pci_enable_device(tpci200->info->pdev) < 0)
return -ENODEV;
Since the memory enable bit in the PCI command register is not guaranteed to
be set by the firmware before probe, accessing MMIO regions before
pci_enable_device() can result in reads returning 0xFFFFFFFF and writes being
dropped. On some architectures, this might even trigger a system-crashing
PCI master abort.
Should pci_enable_device() be called earlier in tpci200_pci_probe() before
any MMIO access occurs?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260723-pci_id_fix-v4-0-3580726844e1@garyguo.net?part=3
next prev parent reply other threads:[~2026-07-24 22:02 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-23 22:00 [PATCH v4 0/9] PCI: Fix UAF and TOCTOU related to dynamic ID Gary Guo
2026-07-23 22:00 ` [PATCH v4 1/9] ata: ata_generic: don't store pci_device_id Gary Guo
2026-07-24 22:02 ` sashiko-bot
2026-07-23 22:00 ` [PATCH v4 2/9] scsi: nsp32: " Gary Guo
2026-07-24 22:02 ` sashiko-bot
2026-07-23 22:00 ` [PATCH v4 3/9] ipack: tpci200: " Gary Guo
2026-07-24 22:02 ` sashiko-bot [this message]
2026-07-23 22:00 ` [PATCH v4 4/9] mlxsw: pci: " Gary Guo
2026-07-24 22:02 ` sashiko-bot
2026-07-23 22:00 ` [PATCH v4 5/9] agp/via: Don't rely on address of pci_device_id Gary Guo
2026-07-24 22:02 ` sashiko-bot
2026-07-23 22:00 ` [PATCH v4 6/9] agp/amd-k7: " Gary Guo
2026-07-24 22:02 ` sashiko-bot
2026-07-23 22:00 ` [PATCH v4 7/9] PCI: Make pci_match_one_device() match on ID instead of device Gary Guo
2026-07-24 22:02 ` sashiko-bot
2026-07-24 22:29 ` Bjorn Helgaas
2026-07-23 22:00 ` [PATCH v4 8/9] PCI: Fix dyn_id add TOCTOU Gary Guo
2026-07-24 22:02 ` sashiko-bot
2026-07-24 22:29 ` Bjorn Helgaas
2026-07-23 22:00 ` [PATCH v4 9/9] PCI: Fix UAF when probe runs concurrent to dyn ID removal Gary Guo
2026-07-24 22:02 ` sashiko-bot
2026-07-24 22:30 ` Bjorn Helgaas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260724220202.731C51F000E9@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=cassel@kernel.org \
--cc=dlemoal@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=gary@garyguo.net \
--cc=linux-ide@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.