From: sashiko-bot@kernel.org
To: "Hui Peng" <benquike@gmail.com>
Cc: linux-pci@vger.kernel.org
Subject: Re: [PATCH v2 2/2] PCI/VGA: invalidate open user references in vga_arbiter_del_pci_device()
Date: Mon, 21 Sep 2026 05:38:13 +0000 [thread overview]
Message-ID: <20260921053814.362581F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260921052702.1725696-2-benquike@gmail.com>
> When a PCI VGA device is removed while /dev/vga_arbiter is open,
> vga_arbiter_del_pci_device() removes and frees the vgadev entry, but any
> open struct vga_arb_private on vga_user_list retains dangling pointers to
> the removed pdev in priv->target and priv->cards[i].pdev. Subsequent writes
> to /dev/vga_arbiter or closing the file descriptor in vga_arb_release()
> dereference the removed pdev.
>
> Mark matching priv->target and priv->cards[i].pdev entries as
> PCI_INVALID_CARD under vga_user_lock in vga_arbiter_del_pci_device(), and
> treat PCI_INVALID_CARD like NULL in vga_arb_write() and vga_arb_release().
>
> Tested in QEMU against Linux 7.3.0-rc3 by opening /dev/vga_arbiter,
> selecting PCI:0000:00:02.0, hot-removing the PCI VGA device via
> /sys/bus/pci/devices/0000:00:02.0/remove, and writing "unlock io+mem".
> On the unfixed kernel, priv->target retains a dangling pointer to the
> removed pci_dev so write("unlock io+mem") proceeds past the NULL check
> and returns -EINVAL (-22); with this patch applied, priv->target is set
> to PCI_INVALID_CARD on removal and write("unlock io+mem") immediately
> returns -ENODEV (-19).
>
> Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260921052702.1725696-1-benquike@gmail.com?part=2
next prev parent reply other threads:[~2026-09-21 5:38 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-19 22:26 [PATCH] PCI/VGA: fix inverted vga_tryget() return check and clear removed pci_dev Hui Peng
2026-09-19 22:48 ` sashiko-bot
2026-09-21 5:27 ` [PATCH v2 1/2] PCI/VGA: fix inverted vga_tryget() return check in vga_arb_write() Hui Peng
2026-09-21 5:27 ` [PATCH v2 2/2] PCI/VGA: invalidate open user references in vga_arbiter_del_pci_device() Hui Peng
2026-09-21 5:38 ` sashiko-bot [this message]
2026-09-21 5:36 ` [PATCH v2 1/2] PCI/VGA: fix inverted vga_tryget() return check in vga_arb_write() sashiko-bot
2026-09-21 10:39 ` [PATCH] PCI/VGA: fix inverted vga_tryget() return check and clear removed pci_dev Jani Nikula
2026-09-21 15:09 ` krzk
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260921053814.362581F000FF@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=benquike@gmail.com \
--cc=linux-pci@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.