Re: [PATCH v2 2/3] PCI: rzg3s: Propagate platform_get_irq_byname() errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing cleanup of chained IRQ handlers on error paths leaves dangling pointers to freed driver memory, leading to a Use-After-Free when probe is deferred.
--

--- Patch [2]: [PATCH v2 2/3] PCI: rzg3s: Propagate platform_get_irq_byname() errors ---
commit 682dcda0e92e75148db8e1626ef00a4a02243870
Author: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

PCI: rzg3s: Propagate platform_get_irq_byname() errors

This commit updates rzg3s_pcie_init_irqdomain() to propagate the original
error code from platform_get_irq_byname() instead of always returning
-EINVAL. This allows the driver core to properly retry probing when the
interrupt provider returns -EPROBE_DEFER.

> diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
> index 01488660ab081..f51b5d7c19983 100644
> --- a/drivers/pci/controller/pcie-rzg3s-host.c
> +++ b/drivers/pci/controller/pcie-rzg3s-host.c
> @@ -1019,7 +1019,7 @@ static int rzg3s_pcie_init_irqdomain(struct rzg3s_pcie_host *host)
>  
>  		irq = platform_get_irq_byname(pdev, irq_name);
>  		if (irq < 0)
> -			return dev_err_probe(dev, -EINVAL,
> +			return dev_err_probe(dev, irq,
>  					     "Failed to parse and map INT%c IRQ\n",
>  					     'A' + i);

[Severity: High]
This is a pre-existing issue, but does this direct return leave dangling
chained handlers if a subsequent IRQ fails to probe?

Looking at rzg3s_pcie_init_irqdomain(), chained handlers are iteratively
installed on parent interrupts via irq_set_chained_handler_and_data().
If platform_get_irq_byname() fails for a subsequent IRQ (e.g., returning
-EPROBE_DEFER for "intb"), the function returns an error without invoking
irq_set_chained_handler_and_data() with NULL arguments to unregister the
previously installed handlers.

Since this patch explicitly enables probe deferral, this error path becomes
highly reachable. When probe is deferred, devm automatically frees the host
structure, but the IRQ subsystem retains the chained handlers.

If the parent interrupt triggers before the device is reprobed, would
rzg3s_pcie_intx_irq_handler() dereference the freed host pointer and cause
a use-after-free?

It appears this missing cleanup also exists if rzg3s_pcie_init_msi() fails
later in the same function, and during rzg3s_pcie_teardown_irqdomain(),
which removes the domains but leaves the chained handlers registered.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727095843.116950-1-prabhakar.mahadev-lad.rj@bp.renesas.com?part=2