Re: [PATCH v3 8/8] PCI/quirks: Avoid certain address on Genoa systems

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] pci: dangling parent pointer in static resource on host bridge hot-remove
--

commit a726f0ceef0b80da9ff2163d336b376a4bbb5424
Author: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

PCI/quirks: Avoid certain address on Genoa systems

This commit works around a hardware black hole issue on Genoa systems where
a 64kB region at 0x9c000000 returns ~0. It does this by adding a PCI fixup
quirk that reserves this address space before any overlapping allocations
are made.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=222074

> diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
> index b301c6c8df753..cc463bf492b63 100644
> --- a/arch/x86/pci/fixup.c
> +++ b/arch/x86/pci/fixup.c

[ ... ]

> @@ -822,6 +822,42 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
> +static struct resource genoa_black_hole = DEFINE_RES_MEM_NAMED(0x9c000000,
> +							       SZ_64K,
> +							       "reserved");
> +
> +static void genoa_iomem_black_hole(struct pci_dev *dev)
> +{
> +	struct resource *r;
> +
> +	pci_bus_for_each_resource(dev->bus, r) {
> +		if (!r || !r->flags || !resource_assigned(r))
> +			continue;
> +
> +		if (!__resource_contains_unbound(r, &genoa_black_hole))
> +			continue;
> +
> +		if (resource_assigned(&genoa_black_hole))

[Severity: Medium]
Does this resource_assigned() check evaluate to true incorrectly after a host
bridge hot-remove?

When the quirk inserts the static genoa_black_hole resource into the
dynamically allocated host bridge resource window:

insert_resource(r, &genoa_black_hole)
    genoa_black_hole.parent = r;

If the ACPI host bridge is later hot-removed, the PCI core releases its
resource windows by calling release_resource(r). This function unlinks r
from the tree but intentionally does not clear the parent pointers of its
children.

As a result, genoa_black_hole.parent is left as a dangling pointer to the
freed resource r.

If the host bridge is rescanned or re-added, the device is rediscovered
and triggers the quirk again. The quirk checks resource_assigned(), which
evaluates:

static inline bool resource_assigned(const struct resource *res)
{
    return res->parent;
}

Because the pointer is dangling, the check evaluates to true, causing the
quirk to incorrectly skip re-insertion. The rescanned bus is therefore left
vulnerable to the hardware black hole, potentially leading to link loss or
failed initializations.

> +			pci_dbg(dev, "iomem black hole workaround already applied\n");
> +		else if (!insert_resource(r, &genoa_black_hole))
> +			pci_info(dev, "iomem black hole workaround enabled\n");
> +		else
> +			pci_dbg(dev, "iomem black hole workaround add failed\n");
> +		return;
> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013130948.6231-1-ilpo.jarvinen@linux.intel.com?part=8