Re: [PATCH 1/2] ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] acpi_pci_root_add() leaves a dangling pointer in device->driver_data on the dmar_device_add() error path.
--

commit c50bc9cc7a48e4b92d2f6107b97e5bdf5d2b47a4
Author: Chen Pei <cp0613@linux.alibaba.com>

ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach

This commit clears _DEP dependencies at the end of acpi_pci_root_add(),
allowing consumers like ACPI0017 CXL root devices to safely enumerate
once the PCI root bridge has been attached.

> diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
> index a0ba64e45e8ab..4c06c3ffd0cbb 100644
> --- a/drivers/acpi/pci_root.c
> +++ b/drivers/acpi/pci_root.c
> @@ -755,6 +755,10 @@ static int acpi_pci_root_add(struct acpi_device *device,
>  	pci_lock_rescan_remove();
>  	pci_bus_add_devices(root->bus);
>  	pci_unlock_rescan_remove();
> +
> +	/* Clear _DEP dependencies to allow consumers to enumerate */
> +	acpi_dev_clear_dependencies(device);
> +
>  	return 1;
>  
>  remove_dmar:
>  	if (hotadd)
>  		dmar_device_remove(handle);
>  end:
>  	kfree(root);

[Severity: High]
This is a pre-existing issue, but does the dmar_device_add() error path
leave a dangling pointer in device->driver_data?

Earlier in acpi_pci_root_add(), the allocated root object is assigned to
device->driver_data:

	root->device = device;
	root->segment = segment & 0xFFFF;
	device->driver_data = root;

If dmar_device_add() fails during a hot-add, the code jumps to the end
label and frees the root pointer via kfree().

However, it doesn't explicitly reset device->driver_data to NULL, unlike
the later pci_acpi_scan_root() error path. Since the ACPI core does not
automatically clear driver_data on an attach failure, could subsequent calls
to acpi_pci_find_root() by other subsystems fetch and dereference this freed
pointer?

>  	return result;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260526025118.38935-1-cp0613@linux.alibaba.com?part=1