Re: [PATCH 3/3] drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds array access / buffer overflow in hisi_l3c_pmu_init_ext() due to missing upper bound check on device tree IRQ count.
--

--- Patch [3]: [PATCH 3/3] drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe() ---
commit 439e35f073703c68b0687dec637faec43876da5e
Author: Pan Chuang <panchuang@vivo.com>

drivers/perf: hisi: Remove redundant dev_err()/dev_err_probe()

This commit removes redundant driver-specific error logs when calling
devm_request_irq(). The core framework automatically handles the error
reporting on failure.

> diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
> index f963e4f9e5527..56a88fb0d3c2c 100644
> --- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
> +++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
> @@ -604,8 +604,7 @@ static int hisi_l3c_pmu_init_ext(struct hisi_pmu *l3c_pmu, struct platform_devic
>  				       IRQF_NOBALANCING | IRQF_NO_THREAD,
>  				       irqname, l3c_pmu);
>  		if (ret < 0)
> -			return dev_err_probe(&pdev->dev, ret,
> -				"Fail to request EXT IRQ: %d.\n", irq);
> +			return ret;
>  
>  		hisi_l3c_pmu->ext_irq[i] = irq;

[Severity: High]
This is a pre-existing issue, but does this loop risk writing out of bounds
if the device tree specifies more IRQs than expected?

In hisi_l3c_pmu_init_ext(), the total number of IRQs is fetched with
platform_irq_count(pdev). The code enforces a lower bound but misses an
upper bound check:

    ext_num = platform_irq_count(pdev);
    if (ext_num < L3C_MAX_EXT)
        return -ENODEV;
    hisi_l3c_pmu->ext_num = ext_num - 1;

If a misconfigured device tree provides more IRQs than expected,
hisi_l3c_pmu->ext_num can exceed the fixed size of the ext_base and ext_irq
arrays, which are bound by L3C_MAX_EXT.

The loop iterating up to hisi_l3c_pmu->ext_num would then write out of
bounds into the ext_irq array at the end of this block.

Could we add an upper bound check for ext_num to prevent memory corruption
if too many IRQs are present?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717103123.34887-1-panchuang@vivo.com?part=3