Re: [PATCH 3/5] powerpc/pci: Use official API to iterate over PCI buses

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Iterating over PCI buses inside the `pciconfig_iobase` syscall using `pci_find_next_bus()` is vulnerable to Use-After-Free (UAF) due to concurrent PCI hot-remove.
--

commit 84b1457ab2cb35e500a53ad0e4cc8f1330b88073
Author: Gerd Bayer <gbayer@linux.ibm.com>

powerpc/pci: Use official API to iterate over PCI buses

Replace iterating over pci_root_buses with the official
pci_find_next_bus() call provided by PCI core. This allows to make
pci_root_buses private to PCI core.

[ ... ]

> diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
> index e27342ef128b8..f816d063b984e 100644
> --- a/arch/powerpc/kernel/pci_64.c
> +++ b/arch/powerpc/kernel/pci_64.c
> @@ -248,7 +248,7 @@ SYSCALL_DEFINE3(pciconfig_iobase, long, which, unsigned long, in_bus,
>  	 * used on pre-domains setup. We return the first match
>  	 */
>  
> -	list_for_each_entry(tmp_bus, &pci_root_buses, node) {
> +	while ((tmp_bus = pci_find_next_bus(tmp_bus)) != NULL) {
>  		if (in_bus >= tmp_bus->number &&
>  		    in_bus <= tmp_bus->busn_res.end) {
>  			bus = tmp_bus;

While the previous list_for_each_entry loop was also unprotected against
concurrent hot-removes, does the new pci_find_next_bus() loop still leave a
vulnerability to a use-after-free?

Since pciconfig_iobase is a syscall, it can execute concurrently with PCI
hotplug operations. The pci_find_next_bus() helper acquires and drops
pci_bus_sem internally, returning an unreferenced struct pci_bus pointer.

If a concurrent root bus hot-remove frees tmp_bus immediately after
pci_find_next_bus() releases the semaphore, wouldn't the accesses to
tmp_bus->number and tmp_bus->busn_res.end evaluate freed memory?

Furthermore, if the loop continues, could passing the freed pointer back into
pci_find_next_bus() cause a crash when it evaluates from->node.next?

Would it be appropriate to hold pci_lock_rescan_remove() or acquire a reference
while traversing the buses here?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260515-priv_root_buses-v1-0-f8e393c57390@linux.ibm.com?part=3