Re: [PATCH v5 7/8] x86/amd_node: Restrict SMN setup to AMD CPUs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `amd_roots` array stores dangling pointers to PCI devices because their reference counts are incorrectly dropped during the iteration loop.
--

commit 263066910679f0796c85e4dd7d844bda35fa7403
Author: Lin Wang <wanglin@open-hieco.net>

x86/amd_node: Restrict SMN setup to AMD CPUs

amd_smn_init() divides host bridge roots among amd_num_nodes() entries
in PCI enumeration order. This restricts AMD SMN setup and root discovery
to AMD CPUs.

> diff --git a/arch/x86/kernel/amd_node.c b/arch/x86/kernel/amd_node.c
> index 762585775b5a2..a7190cec69954 100644
> --- a/arch/x86/kernel/amd_node.c
> +++ b/arch/x86/kernel/amd_node.c
> @@ -229,8 +229,7 @@ static struct pci_dev *get_next_root(struct pci_dev *root)
>  		if (root->devfn)
>  			continue;
>  
> -		if (root->vendor != PCI_VENDOR_ID_AMD &&
> -		    root->vendor != PCI_VENDOR_ID_HYGON)
> +		if (root->vendor != PCI_VENDOR_ID_AMD)
>  			continue;
>  
>  		break;

[Severity: High]
This isn't a bug introduced by this patch, but does the amd_roots array
store dangling pointers to PCI devices because their reference counts are
incorrectly dropped during the iteration loop?

This function delegates to pci_get_class(), which by design drops the
reference count of the device passed to it. In the second loop of
amd_smn_init(), a newly matched root device is stored into amd_roots
without acquiring an additional reference:

arch/x86/kernel/amd_node.c:amd_smn_init() {
    ...
	while (node < num_nodes && (root = get_next_root(root))) {
		/* Use one root for each node and skip the rest. */
		if (count++ % roots_per_node)
			continue;

		pci_dbg(root, "is root for AMD node %u\n", node);
		amd_roots[node++] = root;
	}
    ...
}

In the next iteration, the loop condition root = get_next_root(root) passes
that same root back to pci_get_class(), immediately decrementing its
reference count. This leaves the amd_roots array populated with dangling
pointers.

Conversely, the reference count of the very last device retrieved is leaked
because the loop terminates when node < num_nodes fails before it can be
passed back into get_next_root().

While host bridges are typically not hot-removable in this architecture, could
this be a structural use-after-free and reference leak?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910082734.3771675-1-wanglin@open-hieco.net?part=7