Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues: - [Low] Unused label `out_free_domain:` causes a compiler warning. Pre-existing issues: - [High] Use-After-Free on early boot error path when `xive_init_ipis()` fails. -- --- Patch [1]: [PATCH 1/4] powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation --- commit 4043ea10e99c6ca83c1b85c8920beef1a521e167 Author: Gou Hao <[email protected]> powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation kzalloc_objs with the __GFP_NOFAIL flag will never return NULL, so the subsequent NULL check is unreachable dead code. Remove it. > diff --git a/arch/powerpc/sysdev/xive/common.c > b/arch/powerpc/sysdev/xive/common.c > index dadd1f46ec939..79d7854259cb4 100644 > --- a/arch/powerpc/sysdev/xive/common.c > +++ b/arch/powerpc/sysdev/xive/common.c > @@ -1134,9 +1134,6 @@ static int __init xive_init_ipis(void) > > xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids, > GFP_KERNEL | __GFP_NOFAIL); > - if (!xive_ipis) > - goto out_free_domain; [Severity: Low] Does removing this goto leave out_free_domain: as an unused label at the end of xive_init_ipis()? This might cause a compiler warning. [Severity: High] This isn't a bug introduced by this patch, but does the error path in xive_init_ipis() lead to a use-after-free? If irq_domain_alloc_irqs() fails later in this function, it takes the error path: arch/powerpc/sysdev/xive/common.c:xive_init_ipis() { ... out_free_xive_ipis: kfree(xive_ipis); out_free_domain: ... } The global pointer xive_ipis is freed but not set to NULL. The caller xive_smp_probe() ignores the return value of xive_init_ipis() and continues execution, eventually dereferencing the dangling pointer: arch/powerpc/sysdev/xive/common.c:xive_smp_probe() { ... xive_init_ipis(); /* Allocate and setup IPI for the boot CPU */ xive_setup_cpu_ipi(smp_processor_id()); ... } Which accesses the freed pointer: arch/powerpc/sysdev/xive/common.c:xive_ipi_cpu_to_irq() { return xive_ipis[early_cpu_to_node(cpu)].irq; } Can this cause memory corruption or a crash if early IPI setup fails? > - > for_each_node(node) { > struct xive_ipi_desc *xid = &xive_ipis[node]; > struct xive_ipi_alloc_info info = { node }; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
