Re: [PATCH 2/2] PCI: ultrarisc: Skip MEM outbound iATU setup on DP1000

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing driver `.remove` callback causes a Use-After-Free of PCI host bridge structures when the module is unloaded.
--

commit e72827a32cf8b1eb87517edbf6b7e64e76f36134
Author: Xincheng Zhang <zhangxincheng@ultrarisc.com>

PCI: ultrarisc: Skip MEM outbound iATU setup on DP1000

The DP1000 has 16 outbound iATU windows, one of which is used for the
32-bit MEM aperture. To avoid limiting the 64-bit MEM aperture to the
remaining 13 windows, this commit skips generic DWC MEM outbound iATU
setup, allowing transactions to bypass outbound iATU windows.

> diff --git a/drivers/pci/controller/dwc/pcie-ultrarisc.c b/drivers/pci/controller/dwc/pcie-ultrarisc.c
> index 51e89180490d4..0d4989a0f3afc 100644
> --- a/drivers/pci/controller/dwc/pcie-ultrarisc.c
> +++ b/drivers/pci/controller/dwc/pcie-ultrarisc.c
> @@ -154,6 +154,12 @@ static int ultrarisc_pcie_probe(struct platform_device *pdev)
>  
>  	pp = &pci->pp;
>  
> +	/*
> +	 * DP1000 routes MEM transactions without outbound iATU windows, which
> +	 * avoids the 16-window/4GB-per-window aperture limit.
> +	 */
> +	pp->bypass_ob_mem_iatu = true;
> +
>  	platform_set_drvdata(pdev, ultra);
>  
>  	ret = ultrarisc_pcie_init_clks(ultra);

[Severity: High]
This is a pre-existing issue, but since you are modifying the probe path,
I noticed that ultrarisc_pcie_probe() calls dw_pcie_host_init() which allocates
a PCI host bridge via devres, yet the platform driver lacks a remove callback.

Because the driver registers with module_platform_driver():

static struct platform_driver ultrarisc_pcie_driver = {
	.driver = {
		.name = "ultrarisc-pcie",
		...
	},
	.probe = ultrarisc_pcie_probe,
};
module_platform_driver(ultrarisc_pcie_driver);

Is it possible for a privileged user to unload the module and trigger a
use-after-free?

When the module is unloaded, devres will automatically free the memory for the
pci_host_bridge. Because there is no remove callback in the driver,
dw_pcie_host_deinit() is never invoked to call pci_stop_root_bus() and
pci_remove_root_bus().

Does this leave the PCI core with active references to the freed host bridge
structures after the module is removed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260827055448.1818858-1-zhangxincheng@ultrarisc.com?part=2