Re: [PATCH 3/3] PCI: thunder-pem, hisi, thunder-ecam: Fix ECAM config window use-after-free

[sashiko-bot@kernel.org]

> thunder-pem, hisi and thunder-ecam set .probe = pci_host_common_probe but
> have no ->remove, so unbinding only runs devres_release_all():
> gen_pci_unmap_cfg() -> pci_ecam_free() frees the ECAM config window while
> the bus tree stays registered - only pci_remove_bus() unlinks a bus, and
> only pci_host_common_remove() reaches it for a root bus.  The next config
> access in pci_ecam_map_bus() reads cfg->ops->bus_shift.
> Trigger: DT overlay removal of the node that supplied or enabled it.
> 
> Fix: give each driver the same .remove = pci_host_common_remove that
> pci-host-generic.c got in commit 01fcb7f777a9 ("PCI: Add support for
> unbinding the generic PCI host controller"), so the unlink comes first.
> 
> Fixes: f12b76e56ada ("PCI: thunder: Add PCIe host driver for ThunderX processors")
> Fixes: a2ec1996098c ("PCI: hisi: Add DT almost-ECAM support for Hip06/Hip07 host controllers")
> Fixes: 7b6e7ba8e81a ("PCI: thunder: Add driver for ThunderX-pass{1,2} on-chip devices")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108105640.875-1-getshell@seu.edu.cn?part=3