Re: [PATCH v4 6/8] PCI: rzg3s-host: Move IRQ domain setup code

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] pci: UAF in rzg3s_pcie_teardown_intx() due to inverted teardown order
- [Medium] pci: silent removal of PCI_EXP_LNKCTL2_TLS configuration
--

commit 3b9e569b1b1720a0862f47115eba6a10d96f3784
Author: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>

PCI: rzg3s-host: Move IRQ domain setup code

Subsequent patches add support for the event IRQ to handle link
up/down events. The event IRQ handler will use
rzg3s_pcie_set_max_link_speed(). In preparation for adding event IRQ
support, move the IRQ domain initialization code after
rzg3s_pcie_set_max_link_speed().

> PCI: rzg3s-host: Move IRQ domain setup code

[Severity: Medium]
The commit message indicates this is a refactoring commit to move IRQ domain
setup code. Is the hardware target link speed configuration
(PCI_EXP_LNKCTL2_TLS) silently omitted from rzg3s_pcie_set_max_link_speed()
in this patch?

Omitting the hardware target link speed configuration (PCI_EXP_LNKCTL2)
could lead to link training issues or incorrect PCIe state during local
initialization or hotplug paths.

> diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
> index 40d5ef3e347e4..f4b27a77a89df 100644
> --- a/drivers/pci/controller/pcie-rzg3s-host.c
> +++ b/drivers/pci/controller/pcie-rzg3s-host.c
[ ... ]
> @@ -1169,6 +1095,79 @@ static int rzg3s_pcie_set_max_link_speed(struct rzg3s_pcie_host *host)
>  	return ret;
>  }
>  
> +static void rzg3s_pcie_teardown_intx(struct rzg3s_pcie_host *host, int count)
> +{
> +	if (host->intx_domain)
> +		irq_domain_remove(host->intx_domain);

[Severity: High]
Does this inverted teardown order introduce a use-after-free risk?

By calling irq_domain_remove() before unchaining the interrupt handlers,
host->intx_domain is freed early. If an INTx interrupt fires in this window,
rzg3s_pcie_intx_irq_handler() will be executed and dereference the freed
host->intx_domain.

Can we safely destroy the IRQ domain after unchaining the interrupt handlers?

> +
> +	while (--count >= 0) {
> +		irq_set_chained_handler_and_data(host->intx_irqs[count], NULL,
> +						 NULL);
> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922144629.586997-1-claudiu.beznea@kernel.org?part=6