Re: [PATCH v17 10/11] PCI/CXL: Mask/Unmask CXL protocol errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free (UAF) in devres teardown callback `cxl_mask_proto_irqs` during device hot-removal.
--

commit f060d6be86b55217cf830c823d56a91f3c54980c
Author: Terry Bowman <terry.bowman@amd.com>

PCI/CXL: Mask/Unmask CXL protocol errors

This commit introduces helpers to mask and unmask CXL protocol errors and
wires them into the success paths of cxl_dport_map_ras() and
devm_cxl_port_ras_setup(). Teardown is handled via devm actions tied to
the CXL port devices.

> diff --git a/drivers/cxl/core/ras.c b/drivers/cxl/core/ras.c
> index a98ce0f412adb..b45e2b539b5fa 100644
> --- a/drivers/cxl/core/ras.c
> +++ b/drivers/cxl/core/ras.c
[ ... ]
>  static void cxl_dport_map_ras(struct cxl_dport *dport)
>  {
>  	struct cxl_register_map *map = &dport->reg_map;
>  	struct device *dev = dport->dport_dev;
>  
> -	if (!map->component_map.ras.valid)
> +	if (!map->component_map.ras.valid) {
>  		dev_dbg(dev, "RAS registers not found\n");
> -	else if (cxl_map_component_regs(map, &dport->regs.component,
> -					BIT(CXL_CM_CAP_CAP_ID_RAS)))
> +		return;
> +	}
> +
> +	if (cxl_map_component_regs(map, &dport->regs.component,
> +				   BIT(CXL_CM_CAP_CAP_ID_RAS))) {
>  		dev_dbg(dev, "Failed to map RAS capability.\n");
> +		return;
> +	}
> +
> +	cxl_unmask_proto_interrupts(dev);
> +	if (devm_add_action_or_reset(dport_to_host(dport),
> +				     cxl_mask_proto_irqs, dev))
> +		dev_warn(dev, "failed to register CXL proto-irq mask cleanup\n");
>  }

Could this lead to a use-after-free regression during device hot-removal?

The devres action is registered to the host device (dport_to_host(dport)),
which corresponds to the switch's upstream port. However, the data passed
to the callback is dev (dport->dport_dev), which represents the downstream
PCI device.

During a hot-remove of a CXL switch, the PCI core recursively removes and
frees child devices before unbinding and removing the parent device.

Since there doesn't appear to be a reference held on dport->dport_dev when
setting up this devres action, could the downstream PCI device be freed
while the upstream port is still active?

If so, when the upstream port is finally unbound, its devres actions would
execute and call cxl_mask_proto_irqs(dev) with an already-freed downstream
device pointer, resulting in a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260505173029.2718246-1-terry.bowman@amd.com?part=10