Re: [PATCH] PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal

[Lukas Wunner <lukas@wunner.de>]

On Tue, Jun 18, 2024 at 10:12:32AM -0600, Keith Busch wrote:
> On Tue, Jun 18, 2024 at 12:54:55PM +0200, Lukas Wunner wrote:
> > However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also
> > called on a DPC event.  Commit 53b54ad074de ("PCI/DPC: Await readiness
> > of secondary bus after reset"), which introduced that, failed to
> > appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a
> > reference on the child device because dpc_handler() and pciehp may
> > indeed run concurrently.  The commit was backported to v5.10+ stable
> > kernels, so that's the oldest one affected.
> 
> Caution on applying this to 5.10 and 5.15 stable branches: they don't
> have the fancy "__free" cleanup you're using here. The newer active
> stables are okay, though.

I'll let Greg & Sasha know when they start applying this to stable
kernels that ced085ef369a is a prerequisite for v5.10-stable and
v5.15-stable.  I can rework the patch if they don't want to apply
ced085ef369a to these older versions.

Thanks,

Lukas