Re: [PATCH v17 1/7] PCI: Allow per function PCI slots to fix slot reset on s390

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Lockless access and double-dereference of `dev->slot` in `pci_dev_reset_slot_function()` can lead to a TOCTOU race resulting in a Use-After-Free or NULL pointer dereference.
--

commit 3e69d6bfb3fdb198ceb79bc29354354788895096
Author: Farhan Ali <alifm@linux.ibm.com>

PCI: Allow per function PCI slots to fix slot reset on s390

This commit introduces a per_func_slot flag to struct pci_slot to allow
per-function PCI slots for functions managed through a hypervisor, such as on
s390. It modifies slot matching logic and pci_dev_reset_slot_function() to
account for this new behavior.

[ ... ]

> diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
> index 8f7cfcc000901..d0c9f0166af5c 100644
> --- a/drivers/pci/pci.c
> +++ b/drivers/pci/pci.c
> @@ -4865,8 +4865,9 @@ static int pci_reset_hotplug_slot(struct hotplug_slot *hotplug, bool probe)
>  
>  static int pci_dev_reset_slot_function(struct pci_dev *dev, bool probe)
>  {
> -	if (dev->multifunction || dev->subordinate || !dev->slot ||
> -	    dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)
> +	if (dev->subordinate || !dev->slot ||
> +	    dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET ||
> +	    (dev->multifunction && !dev->slot->per_func_slot))

[Severity: High]
This is a pre-existing issue, but does this lockless access to dev->slot
introduce a time-of-check to time-of-use race condition?

Because dev->slot is read without holding pci_slot_mutex or device_lock(),
a concurrent hotplug removal could clear dev->slot and free the slot
structure in pci_slot_release() while this code is running.

If the compiler reloads the pointer after the !dev->slot check, or if the
pointer is kept in a register while the memory is freed, could accessing
dev->slot->per_func_slot or dev->slot->hotplug below result in a null pointer
dereference or use-after-free?

>  		return -ENOTTY;
>  
>  	return pci_reset_hotplug_slot(dev->slot->hotplug, probe);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260520171113.1111-1-alifm@linux.ibm.com?part=1