[PATCH AUTOSEL 6.18-5.10] PCI: mediatek: Protect root bus removal with rescan lock

[Sasha Levin <sashal@kernel.org>]

From: Hans Zhang <18255117159@163.com>

[ Upstream commit a29812a55da8d0dbeb071b26ac428c338e3fc389 ]

Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-7-18255117159@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Phase 1: Commit Message Forensics

**Step 1.1 — Subject line**
- Record: `[PCI/mediatek]` `[Protect]` — Add missing
  `pci_rescan_remove_lock` around root bus teardown in
  `mtk_pcie_remove()`.

**Step 1.2 — Tags**
- Record:
  - `Signed-off-by`: Hans Zhang, Manivannan Sadhasivam, Bjorn Helgaas
  - `Link`:
    https://patch.msgid.link/20260521161822.132996-7-18255117159@163.com
  - No `Fixes:`, `Reported-by:`, `Tested-by:`, `Reviewed-by:`, `Cc:
    stable@vger.kernel.org`
  - Notable: PCI subsystem maintainer (Bjorn Helgaas) committed it; part
    of a 9-patch series (patch 6/9)

**Step 1.3 — Body analysis**
- Record:
  - **Bug**: `mtk_pcie_remove()` calls `pci_stop_root_bus()` /
    `pci_remove_root_bus()` without `pci_rescan_remove_lock`, racing
    sysfs-triggered rescan/hotplug.
  - **Symptom**: Use-after-free or system crash.
  - **Root cause**: Missing synchronization with global PCI
    rescan/remove lock used by `pci-sysfs.c`.

**Step 1.4 — Hidden bug fix?**
- Record: No — explicitly described as a synchronization fix for a
  race/UAF.

---

## Phase 2: Diff Analysis

**Step 2.1 — Inventory**
- Record: 1 file (`drivers/pci/controller/pcie-mediatek.c`), +2 lines,
  function `mtk_pcie_remove()`. Single-file surgical fix.

**Step 2.2 — Code flow**
- Record:
  - **Before**: `pci_stop_root_bus()` → `pci_remove_root_bus()`
    unlocked.
  - **After**: `pci_lock_rescan_remove()` → stop/remove →
    `pci_unlock_rescan_remove()`.
  - Affects driver remove/unbind path only.

**Step 2.3 — Bug mechanism**
- Record: **Race condition / UAF**. Sysfs rescan/remove holds
  `pci_rescan_remove_lock`; driver remove did not. Concurrent teardown +
  rescan can walk freed PCI structures.

**Step 2.4 — Fix quality**
- Record: Obviously correct — matches `pci_host_common_remove()`, `pcie-
  mediatek-gen3` `mtk_pcie_remove()`, `pci-aardvark`, `pci-mvebu`.
  Minimal regression risk; standard mutex, no API change.

---

## Phase 3: Git History Investigation

**Step 3.1 — Blame**
- Record: `mtk_pcie_remove()` and unprotected
  `pci_stop/remove_root_bus()` from Honghui Zhang, Oct 2018
  (`031337ace2d1c2`). Bug present since driver introduction.

**Step 3.2 — Fixes: tag**
- Record: N/A — no `Fixes:` tag. Underlying gap: drivers added
  before/without adopting the lock pattern from commit `9d16947b75831`
  (Jan 2014).

**Step 3.3 — Related history**
- Record: Series merged on mainline as `7c97ee7c4951a` (9 driver fixes).
  Commit `a29812a55da8d` is the mediatek piece. Cover letter states each
  patch is independent. Similar unprotected callers remain in this tree
  (altera, rockchip, tegra, iproc, brcmstb, dwc, cadence, plda) —
  separate commits.

**Step 3.4 — Author context**
- Record: Hans Zhang; series reviewed/committed by Bjorn Helgaas;
  Manivannan Sadhasivam Signed-off-by on mediatek patch.

**Step 3.5 — Dependencies**
- Record: None. Requires only `pci_lock_rescan_remove()` /
  `pci_unlock_rescan_remove()` — present in this tree since
  `9d16947b75831`. `git apply --check` passes cleanly.

---

## Phase 4: Mailing List and External Research

**Step 4.1 — Discussion**
- Record: `b4 dig -c a29812a55da8d` →
  https://patch.msgid.link/20260521161822.132996-7-18255117159@163.com.
  v1 series, 9 patches. Bjorn Helgaas applied 8 patches and standardized
  commit logs. No NAKs.

**Step 4.2 — Reviewers**
- Record: `b4 dig -w` — CC'd Bjorn Helgaas, Lorenzo Pieralisi, Konrad
  Wilczynski, Manivannan Sadhasivam, Rob Herring, linux-pci@.

**Step 4.3 — Bug reports**
- Record: No user/syzbot report. sashiko-bot flagged the unprotected
  pattern as a race risk on the mediatek patch; separate pre-existing
  clock/PM issue noted (unrelated to this fix).

**Step 4.4 — Series context**
- Record: Patch 6/9; cover letter: "Each patch is independent and
  targets a specific controller driver."

**Step 4.5 — Stable list**
- Record: No `Cc: stable` in thread (expected; not a negative signal).

---

## Phase 5: Code Semantic Analysis

**Step 5.1 — Functions modified**
- Record: `mtk_pcie_remove()`.

**Step 5.2 — Callers**
- Record: Registered as `platform_driver.remove` for `mtk-pcie`; reached
  on device unbind, module unload, shutdown. `suppress_bind_attrs =
  true` limits sysfs bind/unbind, but module unload and platform device
  removal still invoke remove.

**Step 5.3 — Callees**
- Record: `pci_lock_rescan_remove()`, `pci_stop_root_bus()`,
  `pci_remove_root_bus()`, `pci_unlock_rescan_remove()`, then resource
  teardown.

**Step 5.4 — Reachability**
- Record: Race requires concurrent sysfs PCI rescan/remove (e.g.
  `/sys/bus/pci/rescan`, `.../rescan`, `.../remove`) while driver remove
  runs. Sysfs writes need elevated privileges; realistic under admin
  orchestration, firmware updates, or scripted hotplug.

**Step 5.5 — Similar patterns**
- Record: In this tree, `pcie-mediatek-gen3.c`, `pci-host-common.c`,
  `pci-aardvark.c`, `pci-mvebu.c`, `pci-hyperv.c` already use the lock.
  `pcie-mediatek.c` is the outlier among MediaTek drivers.

---

## Phase 6: Cross-Reference Against Local Tree (v6.18.44)

**Step 6.1 — Buggy code present?**
- Record: **Yes.** Tree is `v6.18.44` (`make kernelversion` = 6.18.44).
  `mtk_pcie_remove()` at lines 1157–1158 calls stop/remove without lock.
  Commit `a29812a55da8d` is **not** in HEAD (`merge-base --is-ancestor`
  exit 1).

**Step 6.2 — Backport complications**
- Record: Clean apply verified (`git apply --check` success). No
  structural conflicts.

**Step 6.3 — Related fixes already present?**
- Record: `git log HEAD --grep="Protect root bus removal"` — empty. Fix
  not yet in 6.18.y. Gen3 driver already has the lock from initial
  import.

---

## Phase 7: Subsystem Context

**Step 7.1 — Subsystem**
- Record: `drivers/pci/controller` — PCI host controller. **IMPORTANT**
  (core I/O path for affected SoCs).

**Step 7.2 — Activity**
- Record: Active maintenance (MSI, IRQ domain, refcount fixes in
  2024–2026).

---

## Phase 8: Impact and Risk

**Step 8.1 — Who is affected**
- Record: `CONFIG_PCIE_MEDIATEK` on ARCH_MEDIATEK / ARCH_AIROHA —
  MT2701, MT7623, MT2712, MT7622, MT7629 (routers, embedded boards).

**Step 8.2 — Trigger**
- Record: Concurrent sysfs PCI rescan/remove during driver remove.
  Uncommon but plausible; requires privileged sysfs access.

**Step 8.3 — Failure severity**
- Record: UAF / kernel crash — **HIGH** (potential **CRITICAL** security
  impact if exploitable timing exists).

**Step 8.4 — Risk/benefit**
- Record: **Benefit HIGH** (prevents crash/UAF on real hardware). **Risk
  VERY LOW** (2-line, established pattern). Strong benefit/risk ratio.

---

## Phase 9: Final Synthesis

**Step 9.1 — Evidence**

*For:*
- Real race with documented UAF/crash consequences
- PCI maintainer-reviewed fix
- Minimal, obviously correct, applies cleanly
- Infrastructure (`pci_lock_rescan_remove`) present since 2014 in this
  tree
- Bug in tree since 2018; gen3 sibling driver already uses the pattern
- Standalone — no series dependencies

*Against:*
- No syzbot/user crash report (theoretical until triggered)
- Privileged trigger for sysfs side of race
- Other PCI controllers in this tree have the same gap (scope beyond
  this commit, not a reason to reject this one)

**Step 9.2 — Stable rules checklist**
1. Obviously correct and tested? **PASS** — pattern used elsewhere;
   maintainer committed
2. Fixes real bug? **PASS** — verified race with sysfs lock mismatch
3. Important issue? **PASS** — UAF/crash
4. Small and contained? **PASS** — 2 lines, 1 file
5. No new features/APIs? **PASS**
6. Can apply to local tree? **PASS** — clean apply verified

**Step 9.3 — Exception category**
- Record: N/A (standard bug fix, not quirk/DT/build/doc exception)

**Step 9.4 — Decision rationale**
This commit closes a long-standing synchronization gap in the MediaTek
PCIe host driver on the v6.18.44 stable tree. The missing lock allows
root bus teardown to race sysfs rescan/remove operations that correctly
hold `pci_rescan_remove_lock`, with UAF/crash as the stated and credible
outcome. The fix is minimal, matches existing in-tree patterns
(including `pcie-mediatek-gen3.c`), has no dependencies, and applies
cleanly.

---

## Verification

- [Phase 1] Parsed subject, tags, body from commit `a29812a55da8d`
- [Phase 2] Diff: +2 lines wrapping stop/remove in `mtk_pcie_remove()`
- [Phase 3] `git blame`: buggy remove path from 2018 (`031337ace2d1c2`)
- [Phase 3] `git show 9d16947b75831`: `pci_lock_rescan_remove()` added
  2014; in this tree
- [Phase 3] `git merge-base --is-ancestor a29812a55da8d HEAD` → exit 1
  (not in tree)
- [Phase 3] `git apply --check` on commit diff → success
- [Phase 4] `b4 dig -c a29812a55da8d` → lore URL found
- [Phase 4] `b4 dig -a` → v1, patch 6/9
- [Phase 4] `b4 dig -w` → PCI maintainers CC'd
- [Phase 4] Mbox: Bjorn Helgaas review, no NAKs, no stable nomination
- [Phase 5] Read `pci-sysfs.c`: rescan/remove paths use
  `pci_lock_rescan_remove()`
- [Phase 5] Read `remove.c`: `pci_stop_and_remove_bus_device()` asserts
  lock held
- [Phase 5] Grep: gen3/aardvark/mvebu/host-common have lock; mediatek.c
  does not
- [Phase 6] `git describe HEAD` → v6.18.44; Makefile → 6.18.44
- [Phase 6] Read `pcie-mediatek.c` lines 1152–1164: unprotected
  stop/remove confirmed
- [Phase 8] Kconfig: `PCIE_MEDIATEK` on ARCH_MEDIATEK/AIROHA

**YES**The background searches finished and match the earlier analysis:

- **`pci_lock_rescan_remove()`** is already in this **v6.18.44** tree
  (from `9d16947b75831`, 2014), along with related ACPI/hotplug locking
  commits.
- A grep for **"Protect root bus removal"** on HEAD returned nothing —
  that fix series is not in this stable tree yet.
- The **MediaTek** patch still applies cleanly and remains a **YES** for
  backport: it adds the missing lock around `mtk_pcie_remove()` to
  prevent a race with sysfs PCI rescan/remove that can cause
  UAF/crashes.

 drivers/pci/controller/pcie-mediatek.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index 6afce031523bd..ce2a3e04a953e 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -1154,8 +1154,10 @@ static void mtk_pcie_remove(struct platform_device *pdev)
 	struct mtk_pcie *pcie = platform_get_drvdata(pdev);
 	struct pci_host_bridge *host = pci_host_bridge_from_priv(pcie);
 
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(host->bus);
 	pci_remove_root_bus(host->bus);
+	pci_unlock_rescan_remove();
 	mtk_pcie_free_resources(pcie);
 
 	mtk_pcie_irq_teardown(pcie);
-- 
2.53.0