Re: [PATCH AUTOSEL 6.18-5.10] PCI: altera: Protect root bus removal with rescan lock

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but missing cleanup of IRQ domain and chained handler in altera_pcie_probe() error paths leads to a resource leak and potential Use-After-Free.
--

commit c2931eaed1e42d3e3d53dfa366745c5d1ac05fe3
Author: Hans Zhang <18255117159@163.com>

PCI: altera: Protect root bus removal with rescan lock

Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs. Such races may lead to use-after-free issues or system crashes.

Link: https://patch.msgid.link/20260521161822.132996-4-18255117159@163.com

> diff --git a/drivers/pci/controller/pcie-altera.c b/drivers/pci/controller/pcie-altera.c
> index 3dbb7adc421c4..7e1db267ae342 100644
> --- a/drivers/pci/controller/pcie-altera.c
> +++ b/drivers/pci/controller/pcie-altera.c
> @@ -1045,8 +1045,10 @@ static void altera_pcie_remove(struct platform_device *pdev)
>  	struct altera_pcie *pcie = platform_get_drvdata(pdev);
>  	struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
>  
> +	pci_lock_rescan_remove();
>  	pci_stop_root_bus(bridge->bus);
>  	pci_remove_root_bus(bridge->bus);
> +	pci_unlock_rescan_remove();
>  	altera_pcie_irq_teardown(pcie);
>  }

[Severity: High]
This isn't a bug introduced by this patch, but does altera_pcie_probe() leak
the IRQ domain and leave a chained IRQ handler pointing to freed memory on
error?

In altera_pcie_probe(), altera_pcie_parse_dt() installs a chained IRQ handler:

drivers/pci/controller/pcie-altera.c:altera_pcie_probe() {
    ...
	ret = altera_pcie_parse_dt(pcie);
	if (ret) {
		dev_err(dev, "Parsing DT failed\n");
		return ret;
	}

	ret = altera_pcie_init_irq_domain(pcie);
	if (ret) {
		dev_err(dev, "Failed creating IRQ Domain\n");
		return ret;
	}
    ...
}

If altera_pcie_init_irq_domain() fails, it returns directly without clearing
the chained IRQ handler.

Similarly, if pci_host_probe() fails at the end of the function:

drivers/pci/controller/pcie-altera.c:altera_pcie_probe() {
    ...
	return pci_host_probe(bridge);
}

The function returns the error directly, which causes devres to free the
pcie structure. However, the chained IRQ handler is still active and will
now point to freed memory, potentially causing a Use-After-Free crash if a
shared interrupt fires. Also, the irq domain allocated in
altera_pcie_init_irq_domain() is leaked.

Should altera_pcie_probe() use goto error paths to call
altera_pcie_irq_teardown() on these failures?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831133314.4125787-58-sashal@kernel.org?part=1