[PATCH] ata: pata_sl82c105: fix bridge revision use-after-free

[PATCH] ata: pata_sl82c105: fix bridge revision use-after-free

[Hongyan Xu]

pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
("PCI: Change all drivers to use pci_device->revision") replaced a
configuration-space read with direct access to the cached revision field,
but left that access after pci_dev_put(). The bridge may therefore be freed
before its revision is read.

Read the revision before dropping the reference.

Fixes: 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/ata/pata_sl82c105.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c
index 2d24c6b3e9d9..25bce3fe2a10 100644
--- a/drivers/ata/pata_sl82c105.c
+++ b/drivers/ata/pata_sl82c105.c
@@ -264,6 +264,7 @@ static struct ata_port_operations sl82c105_port_ops = {
 static int sl82c105_bridge_revision(struct pci_dev *pdev)
 {
 	struct pci_dev *bridge;
+	u8 revision;
 
 	/*
 	 * The bridge should be part of the same device, but function 0.
@@ -285,8 +286,9 @@ static int sl82c105_bridge_revision(struct pci_dev *pdev)
 	/*
 	 * We need to find function 0's revision, not function 1
 	 */
+	revision = bridge->revision;
 	pci_dev_put(bridge);
-	return bridge->revision;
+	return revision;
 }
 
 static void sl82c105_fixup(struct pci_dev *pdev)
-- 
2.50.1.windows.1

Re: [PATCH] ata: pata_sl82c105: fix bridge revision use-after-free

[Niklas Cassel]

On Thu, Aug 06, 2026 at 02:06:28PM +0800, Hongyan Xu wrote:
> pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
> ("PCI: Change all drivers to use pci_device->revision") replaced a
> configuration-space read with direct access to the cached revision field,
> but left that access after pci_dev_put(). The bridge may therefore be freed
> before its revision is read.
> 
> Read the revision before dropping the reference.
> 
> Fixes: 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision")
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
>  drivers/ata/pata_sl82c105.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c
> index 2d24c6b3e9d9..25bce3fe2a10 100644
> --- a/drivers/ata/pata_sl82c105.c
> +++ b/drivers/ata/pata_sl82c105.c
> @@ -264,6 +264,7 @@ static struct ata_port_operations sl82c105_port_ops = {
>  static int sl82c105_bridge_revision(struct pci_dev *pdev)
>  {
>  	struct pci_dev *bridge;
> +	u8 revision;
>  
>  	/*
>  	 * The bridge should be part of the same device, but function 0.
> @@ -285,8 +286,9 @@ static int sl82c105_bridge_revision(struct pci_dev *pdev)
>  	/*
>  	 * We need to find function 0's revision, not function 1
>  	 */
> +	revision = bridge->revision;
>  	pci_dev_put(bridge);
> -	return bridge->revision;
> +	return revision;
>  }
>  
>  static void sl82c105_fixup(struct pci_dev *pdev)
> -- 
> 2.50.1.windows.1
> 

Makes sense to me:
Reviewed-by: Niklas Cassel <cassel@kernel.org>

Re: [PATCH] ata: pata_sl82c105: fix bridge revision use-after-free

[Damien Le Moal]

On 2026/08/05 23:06, Hongyan Xu wrote:
> pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
> ("PCI: Change all drivers to use pci_device->revision") replaced a
> configuration-space read with direct access to the cached revision field,
> but left that access after pci_dev_put(). The bridge may therefore be freed
> before its revision is read.
> 
> Read the revision before dropping the reference.
> 
> Fixes: 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision")
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>

Applied to for-7.2-fixes. Thanks!

-- 
Damien Le Moal
Western Digital Research