Re: [PATCH v11 10/10] PCI: of: Avoid np->data usage for the node changeset

[Herve Codina <herve.codina@bootlin.com>]

Hi All,

On Wed,  9 Sep 2026 10:01:09 +0200
Herve Codina <herve.codina@bootlin.com> wrote:

> of_pci_remove_node() and of_pci_remove_host_bridge_node() check
> whether the node is dynamic but not whether it has valid private data.
> 
> During the node creation, an OF changeset is used and this changeset is
> stored in np->data to be available for removal functions.
> 
> If, for instance, a PCI host bridge is created using a device-tree
> overlay, the related node will have the dynamic flag set but np->data
> will be NULL. This leads to NULL pointer dereferences.
> 
> Checking for a non-NULL np->data pointer to determine if the node has
> been created by the PCI node creation process is not enough. Indeed,
> on some platforms like PowerPC, the OF_RECONFIG_ATTACH_NODE notifier
> (e.g., in the pci_dn_reconfig_notifier() function) intercepts node
> additions and populates np->data with its own structure, such as a
> struct pci_dn. In that case, np->data is not NULL but it is not related
> to our changeset stored during the PCI node process creation.
> 
> Avoid the usage of np->data to store the changeset used during the PCI
> node creation. Store our changeset in a more relevant structure: either
> struct pci_dev when the node is created for a PCI device or struct
> pci_host_bridge when the node is created for the PCI host bridge.
> 
> With that done, no ambiguity remains on removal. Indeed, this changeset,
> if non-NULL, is the one used during PCI node creation. Check and use
> this changeset on the removal process.
> 
> Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
> Fixes: 1f340724419e ("PCI: of: Create device tree PCI host bridge node")
> Cc: <stable+noautosel@kernel.org> # Issue not triggered but could be a problem
> Signed-off-by: Herve Codina <herve.codina@bootlin.com>
> ---
>  drivers/pci/of.c    | 28 ++++++++++++++--------------
>  include/linux/pci.h | 11 +++++++++++
>  2 files changed, 25 insertions(+), 14 deletions(-)
> 

Shashiko has reported issues [0].

IMO, those issues cannot be triggered but I would like to know the opinion of
other people and Maintainers.

Of course, I can update the code to more defensive but is it really needed?

Let me know if I need to send a new iteration with the update (check for a
null np and set cset to NULL after the kfree() call in remove functions).

[0] https://lore.kernel.org/all/20260909110623.2e6bbc89@bootlin.com/

Best regards,
Hervé