Re: [PATCH v2 2/4] ACPI: PCI: Introduce acpi_dev_get_pci_dev()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free in acpi_get_pci_dev() due to unpinned acpi_device pointer
--

--- Patch [2]: [PATCH v2 2/4] ACPI: PCI: Introduce acpi_dev_get_pci_dev() ---
commit 96691f509a95b92252e42efea5c07ebf2acebfd2
Author: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

ACPI: PCI: Introduce acpi_dev_get_pci_dev()

Some acpi_get_pci_dev() callers already have a struct ACPI device for
which they want to get the struct pci_dev pointer of the associated
PCI device. Add acpi_dev_get_pci_dev() to handle this and turn
acpi_get_pci_dev() into a static inline helper.

> diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
> index 402b97d121381..bff2ca035fcf3 100644
> --- a/include/acpi/acpi_drivers.h
> +++ b/include/acpi/acpi_drivers.h
> @@ -59,14 +59,19 @@ int acpi_pci_link_free_irq(acpi_handle handle);
[ ... ]
> +static inline struct pci_dev *acpi_get_pci_dev(acpi_handle handle)
> +{
> +	return acpi_dev_get_pci_dev(acpi_fetch_acpi_dev(handle));
> +}

[Severity: High]
This is a pre-existing issue, but does this inline function expose a
race condition with ACPI hot-remove?

acpi_fetch_acpi_dev() returns an unpinned acpi_device pointer without
incrementing its reference count. If a concurrent ACPI hot-remove event
occurs immediately after the lookup, the device object could be destroyed
and freed by the hotplug workqueue.

When the dangling pointer is passed into acpi_dev_get_pci_dev(), it
gets dereferenced here in drivers/acpi/pci_root.c:

acpi_dev_get_pci_dev() {
    ...
    guard(mutex)(&adev->physical_node_lock);

Could this be prevented by using acpi_get_acpi_dev() to acquire a reference
before calling acpi_dev_get_pci_dev(), and then releasing it with
acpi_dev_put()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/12935400.O9o76ZdvQC@rafael.j.wysocki?part=2