Re: [PATCH v8 3/3] PCI: cadence: Add LGA IP debugfs for LTSSM status

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the `to_pci_epc()` macro is incorrectly applied to the platform device's `dev` object in `cdns_pcie_ep_disable()`, resulting in type confusion and bogus pointer dereference.
--

commit 21d2761732f07216945992f2fa129395035e6bda
Author: Hans Zhang <18255117159@163.com>

PCI: cadence: Add LGA IP debugfs for LTSSM status

This commit extends debugfs support to LGA-based Cadence PCIe controllers.
It makes the ltssm_status file work for both HPA and LGA IPs by selecting
the appropriate register access based on the is_hpa flag.

> diff --git a/drivers/pci/controller/cadence/pcie-cadence-ep.c b/drivers/pci/controller/cadence/pcie-cadence-ep.c
> index c0e1194a936b3..370b19f4d38fb 100644
> --- a/drivers/pci/controller/cadence/pcie-cadence-ep.c
> +++ b/drivers/pci/controller/cadence/pcie-cadence-ep.c
> @@ -655,6 +655,7 @@ void cdns_pcie_ep_disable(struct cdns_pcie_ep *ep)
>  	struct device *dev = ep->pcie.dev;
>  	struct pci_epc *epc = to_pci_epc(dev);

[Severity: High]
This is a pre-existing issue, but does this code pass the correct dev to
to_pci_epc()?

Because ep->pcie.dev represents the parent platform device rather than the
device object embedded inside struct pci_epc, the container_of calculation
inside to_pci_epc() yields an incorrect address.

Will this garbage pointer subsequently passed to pci_epc_mem_free_addr() 
and pci_epc_mem_exit() cause an invalid memory access during device
teardown?

>  
> +	cdns_pcie_debugfs_deinit(&ep->pcie);
>  	pci_epc_deinit_notify(epc);
>  	pci_epc_mem_free_addr(epc, ep->irq_phys_addr, ep->irq_cpu_addr,
>  			      SZ_128K);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701073513.1101559-1-18255117159@163.com?part=3