Re: [PATCH v19 03/18] PCI/TPH: Cache TPH requester capability at probe time

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Memory leak of `idx_data` in `mlx5_st_dealloc_index` when refcount drops to zero.
--

commit 2d469f948c634c33afd2be55f065a0101647132f
Author: Chengwen Feng <fengchengwen@huawei.com>

PCI/TPH: Cache TPH requester capability at probe time

Calculate the negotiated TPH requester type from device and root port
capabilities once in pci_tph_init().

> diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c
> index 489487158b99e..4097787ea98a1 100644
> --- a/drivers/pci/tph.c
> +++ b/drivers/pci/tph.c

[ ... ]

[Severity: High]
This is a pre-existing issue, but does mlx5_st_dealloc_index() leak memory
when the reference count drops to zero?

drivers/net/ethernet/mellanox/mlx5/core/lib/st.c:mlx5_st_dealloc_index() {
...
	if (refcount_dec_and_test(&idx_data->usecount)) {
		xa_erase(&st->idx_xa, st_index);
		/* We leave PCI config space as was before, no mkey will refer to it */
	}
...
}

xa_erase() removes the entry from the XArray and returns its pointer, but the
returned pointer is ignored and the idx_data object is never freed. Can this
accumulate leaked memory over time with repeated steering tag allocations?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260702124224.57168-1-fengchengwen@huawei.com?part=3