Re: [PATCH v5 01/18] platform/x86/intel/pmt: complete pcidev to device update

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Type confusion in `pmt_copy_region` when casting an ACPI device to `struct pci_dev`.
--

commit db191f282e57b915c53aca0bc92d3bca969e1af4
Author: Michael J. Ruhl <michael.j.ruhl@intel.com>

platform/x86/intel/pmt: complete pcidev to device update

The update that moved struct pci_dev usage to struct device is
incomplete. Only telemetry endpoints are covered. This patch changes
the struct intel_pmt_entry pci_dev member to device, and updates
callback usage to use the intel_pmt_entry rather than the telemetry
endpoint.

> diff --git a/drivers/platform/x86/intel/pmt/class.h b/drivers/platform/x86/intel/pmt/class.h
> index a0ece4fc3837d..258cb460e61c2 100644
> --- a/drivers/platform/x86/intel/pmt/class.h
> +++ b/drivers/platform/x86/intel/pmt/class.h
[ ... ]
> @@ -42,7 +41,7 @@ struct intel_pmt_header {
>  
>  struct intel_pmt_entry {
>  	struct telem_endpoint	*ep;

[Severity: High]
This is a pre-existing issue, but does this lead to type confusion in
pmt_copy_region() when an ACPI device has registered telemetry?

In drivers/platform/x86/intel/pmt/telemetry.c:pmt_copy_region(), there is an
unconditional cast of this device (accessed via entry->ep->dev) to a PCI
device:

	struct pci_dev *pdev = to_pci_dev(entry->ep->dev);
	struct oobmsm_plat_info *plat_info;

	plat_info = intel_vsec_get_mapping(pdev);

If the generic struct device is actually an ACPI device (as during runtime
hardware enumeration of ACPI devices that expose PMT telemetry), can
intel_vsec_get_mapping() calling pci_match_id() end up dereferencing
PCI-specific fields (like vendor and device ID) at invalid memory offsets
and cause an out-of-bounds memory read?

This issue appears to have been introduced in commit 353042d54d82 and does
not appear to be resolved by this patch.

> -	struct pci_dev		*pcidev;
> +	struct device		*dev;
>  	struct intel_pmt_header	header;
>  	u32			disc_header[PMT_DISC_DWORDS];
>  	struct bin_attribute	pmt_bin_attr;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903201002.1064889-20-michael.j.ruhl@intel.com?part=1