[PATCH] perf/dwc_pcie: Fix PCI device reference leak in probe

[PATCH] perf/dwc_pcie: Fix PCI device reference leak in probe

[Ruoyu Wang]

pci_get_domain_bus_and_slot() returns a referenced PCI device. When the
subsequent RAS DES capability lookup fails, dwc_pcie_pmu_probe() returns
-ENODEV without releasing that reference. Repeated failed probes can
therefore keep the PCI device allocated after removal.

Move the existing pci_dev_put() immediately after capability discovery
so the temporary lookup reference is released on both success and
failure paths.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 7f35b429802a ("perf/dwc_pcie: fix duplicate pci_dev devices")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/perf/dwc_pcie_pmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/perf/dwc_pcie_pmu.c b/drivers/perf/dwc_pcie_pmu.c
index 5385401fa9cf6..baa736fd9a6ef 100644
--- a/drivers/perf/dwc_pcie_pmu.c
+++ b/drivers/perf/dwc_pcie_pmu.c
@@ -710,10 +710,10 @@ static int dwc_pcie_pmu_probe(struct platform_device *plat_dev)
 	}
 
 	vsec = dwc_pcie_des_cap(pdev);
+	pci_dev_put(pdev);
 	if (!vsec)
 		return -ENODEV;
 
-	pci_dev_put(pdev);
 	name = devm_kasprintf(&plat_dev->dev, GFP_KERNEL, "dwc_rootport_%x", sbdf);
 	if (!name)
 		return -ENOMEM;
-- 
2.51.0

Re: [PATCH] perf/dwc_pcie: Fix PCI device reference leak in probe

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The PMU driver stores a pointer to the PCI device (`pdev`) without retaining a reference, exposing the system to a Use-After-Free (UAF) if the PCI device is hot-removed.
- [High] Concurrent modification of the global dwc_pcie_dev_info_head list without locking.
--

--- Patch [1]: [PATCH] perf/dwc_pcie: Fix PCI device reference leak in probe ---
commit 2589eb488a31451ac7fb41c9454a6b4efd3a7453
Author: Ruoyu Wang <ruoyuw560@gmail.com>

perf/dwc_pcie: Fix PCI device reference leak in probe

This commit addresses a PCI device reference leak when the subsequent RAS
DES capability lookup fails. It moves the pci_dev_put call immediately
after capability discovery to release the reference on both success and
failure paths.

> diff --git a/drivers/perf/dwc_pcie_pmu.c b/drivers/perf/dwc_pcie_pmu.c
> index 6b9ed59de26eb..976e09f0d81b7 100644
> --- a/drivers/perf/dwc_pcie_pmu.c
> +++ b/drivers/perf/dwc_pcie_pmu.c
> @@ -763,10 +763,10 @@ static int dwc_pcie_pmu_probe(struct platform_device *plat_dev)
>  	}
>  
>  	vsec = dwc_pcie_des_cap(pdev);
> +	pci_dev_put(pdev);

[Severity: High]
This is a pre-existing issue, but I have a question about how the PCI device
reference is managed here.

Since pci_dev_put(pdev) is called to drop the reference, is it safe to
subsequently store and dereference this pointer?

In drivers/perf/dwc_pcie_pmu.c:dwc_pcie_pmu_probe(), the pdev pointer is
stored in the PMU structure:

	pcie_pmu->pdev = pdev;

If the PCI device is hot-removed during the initialization window before the
bus notifier is registered in dwc_pcie_pmu_init(), the BUS_NOTIFY_DEL_DEVICE
event could be missed. This would mean the PMU platform device is never
unregistered, and the PCI subsystem would free the struct pci_dev.

Could this leave pcie_pmu->pdev pointing to freed memory, leading to a
use-after-free when subsequent PMU operations or CPU hotplug callbacks like
dwc_pcie_pmu_online_cpu() access it?

>  	if (!vsec)
>  		return -ENODEV;
>  
> -	pci_dev_put(pdev);
>  	name = devm_kasprintf(&plat_dev->dev, GFP_KERNEL, "dwc_rootport_%x", sbdf);

[ ... ]

[Severity: High]
This is a pre-existing issue, but can the global linked list be corrupted
if multiple PCI devices are hot-plugged concurrently?

In drivers/perf/dwc_pcie_pmu.c, the global list dwc_pcie_dev_info_head is
modified without acquiring a lock:

dwc_pcie_register_dev() {
...
	list_add(&dev_info->dev_node, &dwc_pcie_dev_info_head);
...
}

dwc_pcie_unregister_dev() {
...
	list_del(&dev_info->dev_node);
...
}

These functions are invoked by the driver's PCI bus notifier
(dwc_pcie_pmu_nb) responding to BUS_NOTIFY_ADD_DEVICE and
BUS_NOTIFY_DEL_DEVICE events.

Since the driver core's bus notifier chain uses a read-write semaphore
which allows concurrent hotplug events across different devices to invoke
notifiers simultaneously, couldn't this trigger a data race on list_add
and list_del?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814133925.1385687-1-ruoyuw560@gmail.com?part=1

Re: [PATCH] perf/dwc_pcie: Fix PCI device reference leak in probe

[Shuai Xue]

On 8/14/26 9:39 PM, Ruoyu Wang wrote:
> pci_get_domain_bus_and_slot() returns a referenced PCI device. When the
> subsequent RAS DES capability lookup fails, dwc_pcie_pmu_probe() returns
> -ENODEV without releasing that reference. Repeated failed probes can
> therefore keep the PCI device allocated after removal.
> 
> Move the existing pci_dev_put() immediately after capability discovery
> so the temporary lookup reference is released on both success and
> failure paths.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: 7f35b429802a ("perf/dwc_pcie: fix duplicate pci_dev devices")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>   drivers/perf/dwc_pcie_pmu.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/perf/dwc_pcie_pmu.c b/drivers/perf/dwc_pcie_pmu.c
> index 5385401fa9cf6..baa736fd9a6ef 100644
> --- a/drivers/perf/dwc_pcie_pmu.c
> +++ b/drivers/perf/dwc_pcie_pmu.c
> @@ -710,10 +710,10 @@ static int dwc_pcie_pmu_probe(struct platform_device *plat_dev)
>   	}
>   
>   	vsec = dwc_pcie_des_cap(pdev);
> +	pci_dev_put(pdev);
>   	if (!vsec)
>   		return -ENODEV;
>   
> -	pci_dev_put(pdev);
>   	name = devm_kasprintf(&plat_dev->dev, GFP_KERNEL, "dwc_rootport_%x", sbdf);
>   	if (!name)
>   		return -ENOMEM;


Good catch.

Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>

Thanks.
Shuai

Re: [PATCH] perf/dwc_pcie: Fix PCI device reference leak in probe

[Markus Elfring]

…
> Move the existing pci_dev_put() immediately after capability discovery
> so the temporary lookup reference is released on both success and
> failure paths.
…

How do you think about to apply the attribute “__free(pci_dev_put)”?
https://elixir.bootlin.com/linux/v7.2-rc7/source/include/linux/pci.h#L1269

Regards,
Markus