Re: [PATCH v6 3/6] cxl/test: Refactor platform device enumerations

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Failure to assign an error code to `rc` (e.g., `-ENOMEM`) on device allocation failures in `cxl_test_init()`, `cxl_single_topo_init()`, and `cxl_rch_topo_init()`. This causes the functions to return `0` (success) or an uninitialized stack value on failure.
--

commit 49a38c246be39e985c66be86964ee186b899793d
Author: Dave Jiang <dave.jiang@intel.com>

cxl/test: Refactor platform device enumerations

Split all the host bridges, rootports, upstream and downstream ports
enumerations to separate helper functions. This should make adding
type2 hierarchy easier later on.

> diff --git a/tools/testing/cxl/test/cxl.c b/tools/testing/cxl/test/cxl.c
> index 32964420e470a..8abe066080bc8 100644
> --- a/tools/testing/cxl/test/cxl.c
> +++ b/tools/testing/cxl/test/cxl.c
[ ... ]
> @@ -1868,62 +1868,34 @@ static bool __init have_multiple_modparms(void)
[ ... ]
> +static int host_bridges_populate(void)
> +{
> +	int rc = 0;
>  
> -	for (i = 0; i < ARRAY_SIZE(cxl_host_bridge); i++) {
> +	for (int i = 0; i < ARRAY_SIZE(cxl_host_bridge); i++) {
>  		struct acpi_device *adev = &host_bridge[i];
>  		struct platform_device *pdev;
>  
>  		pdev = platform_device_alloc("cxl_host_bridge", i);
> -		if (!pdev)
> +		if (!pdev) {
> +			rc = -ENOMEM;
>  			goto err_bridge;
> +		}

[Severity: High]
This is a pre-existing issue, but I see you fixed the missing rc = -ENOMEM
assignments during failure paths in this newly refactored function and others.

However, does the same missing rc = -ENOMEM assignment still exist in
other unrefactored topology initialization functions in
tools/testing/cxl/test/cxl.c?

For example, in cxl_single_topo_init():

	pdev = platform_device_alloc("cxl_host_bridge",
				     NR_CXL_HOST_BRIDGES + i);
	if (!pdev)
		goto err_bridge;

And similarly in cxl_rch_topo_init(), and for cxl_acpi in cxl_test_init()?

If platform_device_alloc() fails in these functions, could they return an
uninitialized rc or 0?

If they return 0, the test module is successfully loaded despite having freed
mock resources, leaving dangling pointers. When the module is subsequently
unloaded, cxl_test_exit() unregisters these platform devices again.

Could this cause a double-free and a kernel panic?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629202720.3658117-1-dave.jiang@intel.com?part=3