Re: [PATCH v5 2/2] iommu/riscv: create a auxiliary device for HPM

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free in perf and CPU hotplug subsystems due to missing PMU auxiliary device teardown.
--

--- Patch [2]: [PATCH v5 2/2] iommu/riscv: create a auxiliary device for HPM ---
commit b2eacf422db59a71568f8ca57785c37570b8d0bc
Author: Zong Li <[email protected]>

iommu/riscv: create a auxiliary device for HPM

Create an auxiliary device for HPM when the IOMMU supports a
hardware performance monitor.

> diff --git a/drivers/iommu/riscv/iommu.c b/drivers/iommu/riscv/iommu.c
> index cec3ddd7ab103..7f619971bb701 100644
> --- a/drivers/iommu/riscv/iommu.c
> +++ b/drivers/iommu/riscv/iommu.c

[ ... ]

> @@ -565,6 +569,36 @@ static irqreturn_t riscv_iommu_fltq_process(int irq, void *data)
>  	return IRQ_HANDLED;
>  }
>  
> +/*
> + * IOMMU Hardware performance monitor
> + */
> +static void riscv_iommu_pmu_id_free(void *data)
> +{
> +	ida_free(&riscv_iommu_pmu_ida, (unsigned long)data);
> +}
> +
> +static int riscv_iommu_hpm_enable(struct riscv_iommu_device *iommu)
> +{
> +	struct auxiliary_device *auxdev;
> +	int id, ret;
> +
> +	id = ida_alloc(&riscv_iommu_pmu_ida, GFP_KERNEL);
> +	if (id < 0)
> +		return id;
> +
> +	ret = devm_add_action_or_reset(iommu->dev, riscv_iommu_pmu_id_free,
> +				       (void *)(unsigned long)id);
> +	if (ret)
> +		return ret;
> +
> +	auxdev = __devm_auxiliary_device_create(iommu->dev, "riscv-iommu",
> +						"pmu", iommu, id);

[Severity: High]
If the parent RISC-V IOMMU device is removed (e.g., via PCI hot-unplug handled 
by riscv_iommu_pci_remove()), the driver core triggers devres cleanup which 
destroys this auxiliary device.

However, the corresponding PMU driver in drivers/perf/riscv_iommu_pmu.c
does not have a .remove callback to unregister the PMU and CPU hotplug
instances globally.

Since devm will free the struct riscv_iommu_pmu memory when this auxiliary 
device is destroyed, won't this leave dangling pointers in the perf and CPU 
hotplug subsystems?

Could a subsequent CPU hotplug event or userspace perf interaction 
(e.g., via perf_event_open) trigger a use-after-free on the freed memory?

> +	if (!auxdev)
> +		return -ENODEV;
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2