Re: [RFC 07/12] PCI: Convert xen-pciback and pci-driver to pci_is_sriov_* helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Medium] Incomplete implementation: missed conversion of dev->is_virtfn in vpci.c.

Pre-existing issues:
- [High] Concurrent driver unbind can cause a use-after-free of `pcistub_device` in `pci_stub_notifier`.
--

commit 88d02306e6f1bfe4b75d5df018b4e5de4f2ff35a
Author: Dimitri Daskalakis <daskald@meta.com>

PCI: Convert xen-pciback and pci-driver to pci_is_sriov_* helpers

No functional changes.

Assisted-by: Claude:claude-opus-4.7
Signed-off-by: Dimitri Daskalakis <daskald@meta.com>

[Severity: Medium]
The commit message explicitly states its scope is to convert xen-pciback and
pci-driver to the new pci_is_sriov_* helpers. Did we miss converting
dev->is_virtfn in drivers/xen/xen-pciback/vpci.c?

For example, in __xen_pcibk_add_pci_dev() there are still direct accesses:

drivers/xen/xen-pciback/vpci.c:__xen_pcibk_add_pci_dev() {
    ...
	if (!dev->is_virtfn || func) {
    ...
			if (t->dev->is_virtfn && !PCI_FUNC(t->dev->devfn))
    ...
}

Leaving these direct accesses unconverted means they will fail to distinguish
between SRIOV and SIOV VFs when the helpers are updated to check dev->is_sriov
in later patches.

> diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
> index 79a2b5dfd6941..fd5a13f79fcf4 100644
> --- a/drivers/xen/xen-pciback/pci_stub.c
> +++ b/drivers/xen/xen-pciback/pci_stub.c
> @@ -1695,7 +1695,7 @@ static int pci_stub_notifier(struct notifier_block *nb,
>  	if (action != BUS_NOTIFY_UNBIND_DRIVER)
>  		return NOTIFY_DONE;
>  
> -	if (!pdev->is_physfn)
> +	if (!pci_is_sriov_physfn(pdev))
>  		return NOTIFY_DONE;
>  
>  	for (;;) {

[Severity: High]
This is a pre-existing issue, but is there a use-after-free risk here if a
concurrent unbind occurs?

find_vfs() searches the pcistub_devices list and returns a pcistub_device
pointer without taking a reference count via pcistub_device_get():

drivers/xen/xen-pciback/pci_stub.c:pci_stub_notifier() {
    ...
	for (;;) {
		struct pcistub_device *psdev = find_vfs(pdev);
		if (!psdev)
			break;
		device_release_driver(&psdev->dev->dev);
	}
    ...
}

If a concurrent thread unbinds the VF (e.g., via sysfs unbind),
pcistub_remove() executing under the VF's device lock will remove the device
from the list and drop the final reference using pcistub_device_put(), freeing
psdev before the notifier has a chance to execute.

The notifier thread would then dereference the freed psdev memory when
evaluating &psdev->dev->dev in device_release_driver().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604150153.3619662-1-dimitri.daskalakis1@gmail.com?part=7