Re: [PATCH] PCI: pciehp: Make poll mode parameter read-only

[Bjorn Helgaas <helgaas@kernel.org>]

On Mon, Sep 21, 2026 at 10:26:08PM +0800, Runyu Xiao wrote:
> pciehp_request_irq() and pciehp_free_irq() select different resources
> based on the global pciehp_poll_mode parameter. The parameter is
> currently writable through sysfs, so changing it while a controller is
> active can make teardown stop a nonexistent polling thread or call
> free_irq() for an IRQ that was not requested.
> 
> Keep the parameter available for boot and module configuration, but
> prevent runtime changes to the registration mode.
> 
> Reproducer:
> Boot an x86_64 guest in QEMU with a native PCIe hotplug root port and an
> e1000 device, using these device options:
> 
>     -device pcie-root-port,id=rp1,chassis=1,slot=1
>     -device e1000,bus=rp1
> 
> Pass pcie_ports=native pciehp.pciehp_poll_mode=1 to the guest kernel.
> As root in the guest, replace the device name below with a bound pciehp
> service device and run:
> 
>     dev=0000:00:1c.0:pcie004
>     driver=/sys/bus/pci_express/drivers/pciehp
>     echo 0 > /sys/module/pciehp/parameters/poll_mode
>     echo "$dev" > "$driver/unbind"
>     dmesg | grep 'Trying to free already-free IRQ'
> 
> The unfixed kernel accepts the runtime mode change and reports the warning
> when the service device is removed. The fixed kernel rejects the write and
> removes the device without the warning. The mode change is a deliberate
> privileged test action and is not expected during ordinary operation.
> 
> Fixes: 2aeeef119995 ("pciehp: Clean up pcie_init()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM Codex
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Applied to pci/hotplug for v7.4, thanks!

> ---
>  drivers/pci/hotplug/pciehp_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
> index 2cafd3b26f344..5ce32dc7e178f 100644
> --- a/drivers/pci/hotplug/pciehp_core.c
> +++ b/drivers/pci/hotplug/pciehp_core.c
> @@ -38,7 +38,7 @@ int pciehp_poll_time;
>   * not really modular, but the easiest way to keep compat with existing
>   * bootargs behaviour is to continue using module_param here.
>   */
> -module_param(pciehp_poll_mode, bool, 0644);
> +module_param(pciehp_poll_mode, bool, 0444);
>  module_param(pciehp_poll_time, int, 0644);
>  MODULE_PARM_DESC(pciehp_poll_mode, "Using polling mechanism for hot-plug events or not");
>  MODULE_PARM_DESC(pciehp_poll_time, "Polling mechanism frequency, in seconds");
> -- 
> 2.34.1
>