[PATCH] PCI: pciehp: Fix NULL pointer dereference in pciehp_configure_device()

[Priyank Rathod <rathodpriyank@google.com>]

pciehp_configure_device() calls pci_get_dsn() on the result of
pci_get_slot(parent, PCI_DEVFN(0, 0)) without checking for NULL, unlike
the sibling call sites in pcie_init() and pciehp_device_replaced() added
by the same commit.  When hypervisor_isolated_pci_functions() is true
(e.g., Jailhouse or LoongArch) and a non-zero function is hot-added
without Function 0, pci_scan_slot() returns > 0 while pci_get_slot() for
00.0 returns NULL, causing pci_get_dsn() to dereference a NULL pointer
in pci_find_next_ext_capability().

Guard the pci_get_dsn() call against NULL and reset ctrl->dsn to 0 when
Function 0 is absent so ctrl->dsn does not retain a stale value from a
previously removed device.

Fixes: 9d573d19547b ("PCI: pciehp: Detect device replacement during system sleep")
Cc: stable@vger.kernel.org # v6.11+
Signed-off-by: Priyank Rathod <rathodpriyank@google.com>
---
Verification notes:
- Commit 9d573d19547b added 3 pci_get_slot(..., PCI_DEVFN(0, 0)) +
  pci_get_dsn() sites in pciehp: pcie_init() and
  pciehp_device_replaced() both guard against NULL, while
  pciehp_configure_device() omitted the check (the only unchecked
  pci_get_slot() call out of 21 across drivers/pci/).
- On bare metal (!hypervisor_isolated_pci_functions()), missing fn 0
  breaks out of pci_scan_slot() immediately with num == 0 (-ENODEV).
  When hypervisor_isolated_pci_functions() is true, pci_scan_slot()
  scans fn 1..7 and returns num > 0 even when 00.0 is absent, so
  pci_get_slot(parent, PCI_DEVFN(0, 0)) at line 75 returns NULL.
- Using "ctrl->dsn = dev ? pci_get_dsn(dev) : 0;" also avoids keeping a
  stale ctrl->dsn from a prior hotplug cycle since
  pciehp_unconfigure_device() does not clear ctrl->dsn.
---
 drivers/pci/hotplug/pciehp_pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
index 65e50bee1a8c..5f9e8044ea5b 100644
--- a/drivers/pci/hotplug/pciehp_pci.c
+++ b/drivers/pci/hotplug/pciehp_pci.c
@@ -73,7 +73,7 @@ int pciehp_configure_device(struct controller *ctrl)
 	down_read_nested(&ctrl->reset_lock, ctrl->depth);
 
 	dev = pci_get_slot(parent, PCI_DEVFN(0, 0));
-	ctrl->dsn = pci_get_dsn(dev);
+	ctrl->dsn = dev ? pci_get_dsn(dev) : 0;
 	pci_dev_put(dev);
 
  out:

---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20261012-pcie-hotplug-nullref-8f4a2c91b3e7

Best regards,
-- 
Priyank Rathod <rathodpriyank@google.com>