Re: [PATCH v4 3/6] PCI: dwc: rcar-gen4: Add .deinit callback

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing early return or goto in error path of rcar_gen4_add_dw_pcie_ep().
--

commit 2da5cda33af2a170742ef5426b300f42371937c6
Author: Marek Vasut <marek.vasut+renesas@mailbox.org>

    PCI: dwc: rcar-gen4: Add .deinit callback
    
    Add .deinit callback in preparation for R-Car Gen5 support. The
    .deinit callback will be used to tear down the PHY on R-Car Gen5.

> diff --git a/drivers/pci/controller/dwc/pcie-rcar-gen4.c b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
> index a19ebbab2f8c3..04871ac11c348 100644
> --- a/drivers/pci/controller/dwc/pcie-rcar-gen4.c
> +++ b/drivers/pci/controller/dwc/pcie-rcar-gen4.c
[ ... ]
> @@ -580,7 +581,7 @@ static void rcar_gen4_pcie_ep_post_deinit(struct dw_pcie_ep *ep)
>  	struct rcar_gen4_pcie *rcar = to_rcar_gen4_pcie(dw);
>  
>  	writel(0, rcar->base + PCIEDMAINTSTSEN);
> -	rcar_gen4_pcie_common_deinit(rcar);
> +	rcar->drvdata->deinit(rcar);
>  }

[Severity: High]
This isn't a bug introduced by this patch, but looking at
rcar_gen4_add_dw_pcie_ep() in this same file:

	ret = dw_pcie_ep_init_registers(ep);
	if (ret) {
		dev_err(dev, "Failed to initialize DWC endpoint registers\n");
		dw_pcie_ep_deinit(ep);
	}

	pci_epc_init_notify(ep->epc);

	return ret;

Should the error path for dw_pcie_ep_init_registers() return early or jump to
an error handler?

If dw_pcie_ep_init_registers() fails, the code falls through to
pci_epc_init_notify() despite having called dw_pcie_ep_deinit(). This causes
the Endpoint Controller (EPC) framework to spuriously notify registered
listeners (like EPF drivers) that the controller is successfully initialized
when it has actually failed and been de-initialized.

Could this lead to use-after-free or NULL-pointer dereferences in the EPF
drivers attempting to interact with the torn-down EPC?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260905212649.360498-1-marek.vasut+renesas@mailbox.org?part=3