Re: [PATCH v4 2/4] PCI: rzg3s-host: Use shared reset controls for power domain resets

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Chained IRQ handlers are not removed during probe failure or teardown, leading to a potential Use-After-Free.
--

commit 8cee5b223d5c91e47fe4df2561360a3e326a556f
Author: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

PCI: rzg3s-host: Use shared reset controls for power domain resets

This commit switches to shared reset controls for PCIe power resets to prepare
for RZ/V2H(P) support. Multiple PCIe controllers share the same reset line on
this platform, which requires shared ownership of the reset control.

> diff --git a/drivers/pci/controller/pcie-rzg3s-host.c b/drivers/pci/controller/pcie-rzg3s-host.c
> index d86e7516dcc29..a5192e4b58dfb 100644
> --- a/drivers/pci/controller/pcie-rzg3s-host.c
> +++ b/drivers/pci/controller/pcie-rzg3s-host.c
> @@ -1276,9 +1276,9 @@ static int rzg3s_pcie_resets_prepare_and_get(struct rzg3s_pcie_host *host)
>  	for (i = 0; i < data->num_cfg_resets; i++)
>  		host->cfg_resets[i].id = data->cfg_resets[i];
>  
> -	ret = devm_reset_control_bulk_get_exclusive(host->dev,
> -						    data->num_power_resets,
> -						    host->power_resets);
> +	ret = devm_reset_control_bulk_get_shared(host->dev,
> +						 data->num_power_resets,
> +						 host->power_resets);
>  	if (ret)
>  		return ret;
>  

[Severity: High]
This is a pre-existing issue, but I noticed a potential use-after-free
with the chained IRQ handlers in this driver during probe failure or teardown.

In rzg3s_pcie_init_irqdomain(), chained handlers are installed for each INTx
interrupt:

drivers/pci/controller/pcie-rzg3s-host.c:rzg3s_pcie_init_irqdomain() {
	...
	for (i = 0; i < PCI_NUM_INTX; i++) {
		...
		irq = platform_get_irq_byname(pdev, irq_name);
		if (irq < 0)
			return dev_err_probe(dev, -EINVAL, ...);
		
		host->intx_irqs[i] = irq;
		irq_set_chained_handler_and_data(irq,
						 rzg3s_pcie_intx_irq_handler,
						 host);
	}
	...
}

If platform_get_irq_byname() fails on a subsequent loop iteration, the
function returns an error without unregistering the already installed
chained handlers.

Additionally, during teardown, rzg3s_pcie_teardown_irqdomain() does not
clear these handlers:

drivers/pci/controller/pcie-rzg3s-host.c:rzg3s_pcie_teardown_irqdomain() {
	if (IS_ENABLED(CONFIG_PCI_MSI))
		rzg3s_pcie_teardown_msi(host);

	irq_domain_remove(host->intx_domain);
}

Because chained handlers are not managed by devres and persist after the
driver unbinds, could an interrupt on these lines cause
rzg3s_pcie_intx_irq_handler() to dereference the freed host pointer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260602195019.1798126-1-prabhakar.mahadev-lad.rj@bp.renesas.com?part=2