Re: [PATCH] PCI: Fix host bridge double put in pci_register_host_bridge()

[sashiko-bot@kernel.org]

> When device_register() fails for the root bus, the unregister path in
> pci_register_host_bridge() drops a bridge reference with put_device()
> and then releases the bus with put_device(&bus->dev). The bus release
> callback, release_pcibus_dev(), also drops bus->bridge, so the bridge
> loses two references for the one taken when the bus was set up.
> 
> This frees the host bridge before pci_register_host_bridge() returns.
> The caller then drops its own reference on freed memory, either in
> pci_create_root_bus() or in the devres action of
> devm_pci_alloc_host_bridge().
> 
> KASAN reports the use after free in pci_host_probe() when the bus device
> registration fails:
> 
>   BUG: KASAN: slab-use-after-free in pci_host_probe+0x17c/0x180
> [ ... ]
> 
> Fixes: 804443c1f278 ("PCI: Fix reference leak in pci_register_host_bridge()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019161636.2540334-1-nirmoyd@nvidia.com?part=1