Re: [PATCH v13 08/10] PCI: of: Set fwnode device of newly created PCI device nodes

[Herve Codina <herve.codina@bootlin.com>]

On Mon, 12 Oct 2026 14:44:48 +0000
sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] base: TOCTOU data race and UAF on fwnode->dev access
> --
> 
> commit dc94be607770b564614555ac56ea83f070fa3dd4
> Author: Herve Codina <herve.codina@bootlin.com>
> 
> PCI: of: Set fwnode device of newly created PCI device nodes
> 
> Device-tree node can be created when CONFIG_PCI_DYNAMIC_OF_NODES. Those
> nodes are created and filled based on PCI core information but the
> fwnode device field is not set.
> 
> > diff --git a/drivers/pci/of.c b/drivers/pci/of.c
> > index 29b63a9090ae3..8914bfa25dc11 100644
> > --- a/drivers/pci/of.c
> > +++ b/drivers/pci/of.c
> > @@ -736,6 +736,7 @@ void of_pci_remove_node(struct pci_dev *pdev)
> >  	if (!np || !of_node_check_flag(np, OF_DYNAMIC))
> >  		return;
> >  
> > +	fw_devlink_set_device(&np->fwnode, NULL);  
> 
> [Severity: High]
> Does this locklessly clear the fwnode device while another traversal might be
> reading it?
> 
> If a PCI device is concurrently removed while a driver is being bound to
> another device on the same system, of_pci_remove_node() clears fwnode->dev
> locklessly here.
> 
> Concurrently, __fw_devlink_pickup_dangling_consumers() in drivers/base/core.c
> can traverse the fwnode tree and read it locklessly:
> 
> 	if (fwnode->dev && fwnode->dev->bus)
> 		return;

I don't think so.

__fw_devlink_pickup_dangling_consumers() can look at fwnode->dev but those
fwnode->dev are not in the same branch in the tree as the one where the fwnode
being modified is located.

I don't see any cases where __fw_devlink_pickup_dangling_consumers() can
reach our fwnode.

In other word I don't see any race condition on my side and so I will not try
to fix that point except if this "potential" issue is confirmed by other people.
Indeed, I could be wrong in my analysis but without further details, I don't
think the issue reported here can happen.

Best regards,
Hervé