Re: [PATCH v6 4/6] cxl/test: Add hierarchy enumeration support for type2 device

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The error path for cxl_test_init() incorrectly replaces platform_device_unregister() with platform_device_put() for cxl_acpi, leading to a resource leak and potential use-after-free.
--

commit 74917ddebbac04cd137d2f935b0132cdc7d979fe
Author: Dave Jiang <dave.jiang@intel.com>
cxl/test: Add hierarchy enumeration support for type2 device

This commit adds enumeration of type2 device hierarchy in cxl-test. The type2 
device is configured to be directly attached to a root port instead of the 
rp -> switch -> device setup used for type3 hierarchy.

> diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c
> index 8abe066080bc8..1eac06ad46601 100644
> --- a/tools/testing/cxl/test/cxl.c
> +++ b/tools/testing/cxl/test/cxl.c
[ ... ]
> @@ -2156,17 +2314,9 @@ static __init int cxl_test_init(void)
>  err_mem:
>  	cxl_mem_exit();
>  err_root:
> -	platform_device_unregister(cxl_acpi);
> -err_rch:
> -	cxl_rch_topo_exit();
> -err_single:
> -	cxl_single_topo_exit();
> -err_switches:
> -	cxl_switches_remove();
> -err_root_ports:
> -	cxl_rootports_remove();
> -err_host_bridges:
> -	host_bridges_remove();
> +	platform_device_put(cxl_acpi);

[Severity: High]
Does this error path properly tear down the device if cxl_mem_init() or
hmem_test_init() fails?

Since cxl_acpi was already successfully registered with the driver core via
cxl_mock_platform_device_add() earlier in cxl_test_init(), it seems
platform_device_unregister() should be used instead of platform_device_put().

Using platform_device_put() here only drops the initial allocation reference,
leaving the device actively linked in the platform bus and sysfs hierarchies.

Because the module unload upon initialization failure will free its memory,
could any subsequent access to the device's sysfs files dereference invalid
memory and cause a use-after-free?

> +err_topo:
> +	cxl_topo_exit();
>  err_populate:
>  	depopulate_all_mock_resources();
>  err_gen_pool_add:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629202720.3658117-1-dave.jiang@intel.com?part=4