The Linux Kernel Mailing List
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yunhui Cui <cuiyunhui@bytedance.com>,
	Shuai Xue <xueshuai@linux.alibaba.com>,
	Will Deacon <will@kernel.org>, Sasha Levin <sashal@kernel.org>,
	renyu.zj@linux.alibaba.com, mark.rutland@arm.com,
	linux-arm-kernel@lists.infradead.org,
	linux-perf-users@vger.kernel.org
Subject: [PATCH AUTOSEL 6.14 10/18] perf/dwc_pcie: fix duplicate pci_dev devices
Date: Mon, 31 Mar 2025 10:34:00 -0400	[thread overview]
Message-ID: <20250331143409.1682789-10-sashal@kernel.org> (raw)
In-Reply-To: <20250331143409.1682789-1-sashal@kernel.org>

From: Yunhui Cui <cuiyunhui@bytedance.com>

[ Upstream commit 7f35b429802a8065aa61e2a3f567089649f4d98e ]

During platform_device_register, wrongly using struct device
pci_dev as platform_data caused a kmemdup copy of pci_dev. Worse
still, accessing the duplicated device leads to list corruption as its
mutex content (e.g., list, magic) remains the same as the original.

Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Link: https://lore.kernel.org/r/20250220121716.50324-3-cuiyunhui@bytedance.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/perf/dwc_pcie_pmu.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/perf/dwc_pcie_pmu.c b/drivers/perf/dwc_pcie_pmu.c
index 19fa2ba8dd670..f851e070760c5 100644
--- a/drivers/perf/dwc_pcie_pmu.c
+++ b/drivers/perf/dwc_pcie_pmu.c
@@ -565,9 +565,7 @@ static int dwc_pcie_register_dev(struct pci_dev *pdev)
 	u32 sbdf;
 
 	sbdf = (pci_domain_nr(pdev->bus) << 16) | PCI_DEVID(pdev->bus->number, pdev->devfn);
-	plat_dev = platform_device_register_data(NULL, "dwc_pcie_pmu", sbdf,
-						 pdev, sizeof(*pdev));
-
+	plat_dev = platform_device_register_simple("dwc_pcie_pmu", sbdf, NULL, 0);
 	if (IS_ERR(plat_dev))
 		return PTR_ERR(plat_dev);
 
@@ -616,18 +614,26 @@ static struct notifier_block dwc_pcie_pmu_nb = {
 
 static int dwc_pcie_pmu_probe(struct platform_device *plat_dev)
 {
-	struct pci_dev *pdev = plat_dev->dev.platform_data;
+	struct pci_dev *pdev;
 	struct dwc_pcie_pmu *pcie_pmu;
 	char *name;
 	u32 sbdf;
 	u16 vsec;
 	int ret;
 
+	sbdf = plat_dev->id;
+	pdev = pci_get_domain_bus_and_slot(sbdf >> 16, PCI_BUS_NUM(sbdf & 0xffff),
+					   sbdf & 0xff);
+	if (!pdev) {
+		pr_err("No pdev found for the sbdf 0x%x\n", sbdf);
+		return -ENODEV;
+	}
+
 	vsec = dwc_pcie_des_cap(pdev);
 	if (!vsec)
 		return -ENODEV;
 
-	sbdf = plat_dev->id;
+	pci_dev_put(pdev);
 	name = devm_kasprintf(&plat_dev->dev, GFP_KERNEL, "dwc_rootport_%x", sbdf);
 	if (!name)
 		return -ENOMEM;
@@ -642,7 +648,7 @@ static int dwc_pcie_pmu_probe(struct platform_device *plat_dev)
 	pcie_pmu->on_cpu = -1;
 	pcie_pmu->pmu = (struct pmu){
 		.name		= name,
-		.parent		= &pdev->dev,
+		.parent		= &plat_dev->dev,
 		.module		= THIS_MODULE,
 		.attr_groups	= dwc_pcie_attr_groups,
 		.capabilities	= PERF_PMU_CAP_NO_EXCLUDE,
-- 
2.39.5


  parent reply	other threads:[~2025-03-31 14:34 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-03-31 14:33 [PATCH AUTOSEL 6.14 01/18] srcu: Force synchronization for srcu_get_delay() Sasha Levin
2025-03-31 14:33 ` [PATCH AUTOSEL 6.14 02/18] pm: cpupower: bench: Prevent NULL dereference on malloc failure Sasha Levin
2025-03-31 14:33 ` [PATCH AUTOSEL 6.14 03/18] irqchip/gic-v3: Add Rockchip 3568002 erratum workaround Sasha Levin
2025-03-31 14:33 ` [PATCH AUTOSEL 6.14 04/18] x86/mm: Clear _PAGE_DIRTY for kernel mappings when we clear _PAGE_RW Sasha Levin
2025-03-31 14:33 ` [PATCH AUTOSEL 6.14 05/18] x86/percpu: Disable named address spaces for UBSAN_BOOL with KASAN for GCC < 14.2 Sasha Levin
2025-03-31 14:33 ` [PATCH AUTOSEL 6.14 06/18] x86/ia32: Leave NULL selector values 0~3 unchanged Sasha Levin
2025-03-31 14:33 ` [PATCH AUTOSEL 6.14 07/18] x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine Sasha Levin
2025-03-31 14:33 ` [PATCH AUTOSEL 6.14 08/18] perf: arm_pmu: Don't disable counter in armpmu_add() Sasha Levin
2025-03-31 14:33 ` [PATCH AUTOSEL 6.14 09/18] perf/dwc_pcie: fix some unreleased resources Sasha Levin
2025-03-31 14:34 ` Sasha Levin [this message]
2025-03-31 14:34 ` [PATCH AUTOSEL 6.14 11/18] PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() Sasha Levin
2025-03-31 14:34 ` [PATCH AUTOSEL 6.14 12/18] Flush console log from kernel_power_off() Sasha Levin
2025-03-31 14:34 ` [PATCH AUTOSEL 6.14 13/18] cpufreq/amd-pstate: Invalidate cppc_req_cached during suspend Sasha Levin
2025-03-31 14:34 ` [PATCH AUTOSEL 6.14 14/18] arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD Sasha Levin
2025-03-31 14:34 ` [PATCH AUTOSEL 6.14 15/18] xen/mcelog: Add __nonstring annotations for unterminated strings Sasha Levin
2025-03-31 14:34 ` [PATCH AUTOSEL 6.14 16/18] x86/mm/ident_map: Fix theoretical virtual address overflow to zero Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250331143409.1682789-10-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=cuiyunhui@bytedance.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-perf-users@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=renyu.zj@linux.alibaba.com \
    --cc=stable@vger.kernel.org \
    --cc=will@kernel.org \
    --cc=xueshuai@linux.alibaba.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox