From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00CC3606A320 for ; Sun, 8 Nov 2026 14:18:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=Pspzwx+/; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=H3JtE6+S DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:MIME-Version: References:In-Reply-To:Subject:Cc:To:From:Message-ID:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Unsubscribe-Post:List-Owner; bh=ghvcB3Oep4ElkXVE3zWUAz9PnP9Knjes6ZFfb+9rHos=; b=Pspzwx+/ZH7gzXFX4mseXoqAv9 XSLoVazb2MOTVLCSsBUvzc6udgrhmslxEAlqaWcgxDL5Hvinpxe3cbX7OSSEUHHGNSWG7wbkLMr0I VzeMFfXEe5FunYeSGBo6XjLc5usidg26DFqBR5QMsM1QqnqEOoduKToFXHH+xgrnO5Y/lwS0BEMiY ASjTh9W+AgXG966qv3yKbg8mXjIlsCGHwX75ddudBnCW/oXV09iXSDhmi0W0+kH+7RM4WGZhXyMCU yS+4hWaI4HY7mTUSMxbvxmR7VpJ/5SSKLMD4x2jHIAswxaBeqRJGpNvS7p5OigvFWb8QRjLGH/KzM b35tZ2cA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.100.1 #2 (Red Hat Linux)) id 1xQ3j8-0000000GEvT-3TM8; Sun, 08 Nov 2026 14:18:34 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.100.1 #2 (Red Hat Linux)) id 1xQ3j8-0000000GEvK-0Dvo; Sun, 08 Nov 2026 14:18:34 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id D25D740D9A; Sun, 8 Nov 2026 14:18:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B0E3A1F0089F; Sun, 8 Nov 2026 14:18:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794147512; bh=ghvcB3Oep4ElkXVE3zWUAz9PnP9Knjes6ZFfb+9rHos=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=H3JtE6+SZAD59Z0SNA3Zvz10WdKGP+jyNoqW9bIBQrTLt+4IA5mHyHJpj2GCDQ+U2 0mF2z6afAXUx8O2tuJl35LCgByPldWzAqtQiIoByLOm8tfWL1zwmXLxVuo53PfbHu3 lJcaSibs7BCp+9QVB3dnoOGLLJLttv0SIQmdN6rGqhb+LkJ8VJiDxQkcrwQoHEJPiz vLIhaDUEleIe3Zfg718UGhfXyaq8gbnrQ11mMII9yu3RqMnicz2Oa6N9Nj4mj1ZCmE GHNhf4MJCtqtvUVOs65Y46ahDERPglOeB27qIaW9HUXTqcsY9zCJE3IZlCZj0tgSpp 5/kFsc2fFMn1A== Received: from sofa.misterjones.org ([185.219.108.64] helo=lobster-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xQ3j4-0000000Cpjj-2AGA; Sun, 08 Nov 2026 14:18:30 +0000 Date: Sun, 08 Nov 2026 14:21:53 +0000 Message-ID: <87mrrj8ku6.wl-maz@kernel.org> From: Marc Zyngier To: Hongyan Xu Cc: Bjorn Helgaas , linux-pci@vger.kernel.org, Daire McNamara , Conor Dooley , Robert Richter , Zhou Wang , Lorenzo Pieralisi , Krzysztof Wilczynski , Manivannan Sadhasivam , Rob Herring , linux-arm-kernel@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH 1/3] PCI: apple: Fix ECAM config window use-after-free In-Reply-To: <20261108105640.875-2-getshell@seu.edu.cn> References: <20261108105640.875-1-getshell@seu.edu.cn> <20261108105640.875-2-getshell@seu.edu.cn> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) X-Archived-By: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: getshell@seu.edu.cn, bhelgaas@google.com, linux-pci@vger.kernel.org, daire.mcnamara@microchip.com, conor.dooley@microchip.com, rric@kernel.org, wangzhou1@hisilicon.com, lpieralisi@kernel.org, kwilczynski@kernel.org, mani@kernel.org, robh@kernel.org, linux-arm-kernel@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" X-Spam-Status: No, score=-5.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 On Sun, 08 Nov 2026 10:56:37 +0000, Hongyan Xu wrote: > > pcie-apple.c has no ->remove for pci_host_common_init(), so unbinding only > runs devres_release_all(): gen_pci_unmap_cfg() -> pci_ecam_free() frees the > ECAM config window while the bus tree stays registered - only > pci_remove_bus() unlinks a bus, and only pci_host_common_remove() reaches > it for a root bus. The next config access is a use-after-free in > pci_ecam_map_bus(), which reads cfg->ops->bus_shift. > Trigger: CONFIG_PCIE_APPLE=m; as root, one command: # rmmod apple_pcie > > Fix: add .remove = pci_host_common_remove, as pci-host-generic.c does since > commit 01fcb7f777a9 ("PCI: Add support for unbinding the generic PCI host > controller"), so pci_remove_root_bus() unlinks the bus before devres frees > cfg. Scope: cfg lifetime only; its IRQ handlers stay unreleased, so the > module is still unsafe to unload. Then this patch is pointless. Either you prevent the module from being unloaded, or you fully handle the removal. Any intermediate state is just churn. The former is easy enough to do, and gives you the basis to deal with the latter. Thanks, M. -- Jazz isn't dead. It just smells funny.