Re: [PATCH v2] PCI: of_property: Omit bus properties without a subordinate bus

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Potential kernel panic due to unhandled kasprintf() memory allocation failure in of_pci_prop_compatible().
--

commit ad6194f8ec3f58cf7279c3746e014412e0aad530
Author: Angel J <iamanaws@httpd.dev>

PCI: of_property: Omit bus properties without a subordinate bus

This commit updates of_pci_add_properties() to only generate bus-range and
interrupt-map properties when a subordinate bus is present. This prevents an
early boot hang on devices that satisfy pci_is_bridge() but lack a
subordinate bus.

> diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
> index 75a358f73e694..acd2e0f70f01b 100644
> --- a/drivers/pci/of_property.c
> +++ b/drivers/pci/of_property.c
> @@ -361,13 +361,15 @@ int of_pci_add_properties(struct pci_dev *pdev, struct of_changeset *ocs,
>  		if (ret)
>  			return ret;
>  
> -		ret = of_pci_prop_bus_range(pdev, ocs, np);
> -		if (ret)
> -			return ret;
> +		if (pdev->subordinate) {
> +			ret = of_pci_prop_bus_range(pdev, ocs, np);
> +			if (ret)
> +				return ret;
>  
> -		ret = of_pci_prop_intr_map(pdev, ocs, np);
> -		if (ret)
> -			return ret;
> +			ret = of_pci_prop_intr_map(pdev, ocs, np);
> +			if (ret)
> +				return ret;
> +		}
>  	} else {
>  		ret = of_pci_prop_intr_ctrl(pdev, ocs, np);
>  		if (ret)

[Severity: High]
This is a pre-existing issue, but I noticed a potential problem in
of_pci_prop_compatible(), which is called later in this same function.

Can kasprintf() return NULL here under memory pressure?

drivers/pci/of_property.c:of_pci_prop_compatible() {
    ...
    compat_strs[PROP_COMPAT_PCI_VVVV_DDDD] =
        kasprintf(GFP_KERNEL, "pci%x,%x", pdev->vendor, pdev->device);
    ...
}

If this happens, the compat_strs array will contain a NULL pointer.
When this array is passed to of_changeset_add_prop_string_array():

drivers/pci/of_property.c:of_pci_prop_compatible() {
    ...
    ret = of_changeset_add_prop_string_array(ocs, np, "compatible",
                                             compat_strs, PROP_COMPAT_NUM);
    ...
}

Does the changeset API assume all string pointers are valid, leading to a
NULL pointer dereference in strlen() when it iterates over the array?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260912043106.10715-1-iamanaws@httpd.dev?part=1