Re: [PATCH v7 2/2] perf: marvell: Add CN20K DDR PMU support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The PMU driver unregisters the PMU but fails to cancel the hrtimer during device removal, leading to a Use-After-Free when the device memory is freed.
--

commit d18b18c0fd01da6bd683596bdd96464d25ed18a9
Author: Geetha sowjanya <gakula@marvell.com>

perf: marvell: Add CN20K DDR PMU support

The CN20K DRAM Subsystem exposes performance counters for DDR traffic.
This commit adds CN20K register offsets, event maps, and sysfs attributes,
and matches the device via OF and ACPI. Platform data is updated to use
silicon flags to reuse the CN10K PMU code path.

> diff --git a/drivers/perf/marvell_cn10k_ddr_pmu.c b/drivers/perf/marvell_cn10k_ddr_pmu.c
> index 72ac17efd846a..6f638dfe829b8 100644
> --- a/drivers/perf/marvell_cn10k_ddr_pmu.c
> +++ b/drivers/perf/marvell_cn10k_ddr_pmu.c

[ ... ]

> @@ -1098,6 +1294,7 @@ static void cn10k_ddr_perf_remove(struct platform_device *pdev)

[Severity: High]
This is a pre-existing issue, but does this function need to cancel the
hrtimer before returning?

Looking at how the driver manages memory, struct cn10k_ddr_pmu is allocated
with devm_kzalloc() in cn10k_ddr_perf_probe(). This means the memory will be
automatically freed by devres immediately after cn10k_ddr_perf_remove()
finishes.

If the device is unbound via sysfs while a perf event is still active, the
hrtimer could still be running or queued. Because perf_pmu_unregister() does
not stop the PMU's internal timers, would the timer callback
(cn10k_ddr_pmu_timer_handler) execute after the devres cleanup and cause a
use-after-free on the freed ddr_pmu structure?

Could we add hrtimer_cancel(&ddr_pmu->hrtimer) to cn10k_ddr_perf_remove()
to prevent this?

>  #ifdef CONFIG_OF
>  static const struct of_device_id cn10k_ddr_pmu_of_match[] = {
>  	{ .compatible = "marvell,cn10k-ddr-pmu", .data = &cn10k_ddr_pmu_pdata },
> +	{ .compatible = "marvell,cn20k-ddr-pmu", .data = &cn20k_ddr_pmu_pdata },
>  	{ },
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260527154118.12884-1-gakula@marvell.com?part=2