Re: [PATCH] PCI: pciehp: Fix NULL pointer dereference in pciehp_configure_device()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] pciehp: spurious device teardown on resume for devices lacking Function 0
--

commit 26f6592be4bd1ee27e178fdf85798fa2b65a389a
Author: Priyank Rathod <rathodpriyank@google.com>

PCI: pciehp: Fix NULL pointer dereference in pciehp_configure_device()

This commit fixes a NULL pointer dereference in pciehp_configure_device()
when attempting to read the DSN of a newly hot-added device. By guarding the
pci_get_dsn() call against a missing Function 0, it allows devices lacking
Function 0 (such as those under hypervisor isolation) to be successfully
hot-added.

> diff --git a/drivers/pci/hotplug/pciehp_pci.c b/drivers/pci/hotplug/pciehp_pci.c
> index 65e50bee1a8c0..5f9e8044ea5be 100644
> --- a/drivers/pci/hotplug/pciehp_pci.c
> +++ b/drivers/pci/hotplug/pciehp_pci.c
> @@ -73,7 +73,7 @@ int pciehp_configure_device(struct controller *ctrl)
>  	down_read_nested(&ctrl->reset_lock, ctrl->depth);
>  
>  	dev = pci_get_slot(parent, PCI_DEVFN(0, 0));
> -	ctrl->dsn = pci_get_dsn(dev);
> +	ctrl->dsn = dev ? pci_get_dsn(dev) : 0;

[Severity: Medium]
While this allows devices without Function 0 to be successfully hot-added,
will it lead to spurious teardowns upon system resume?

When the system resumes, pciehp_resume_noirq() calls pciehp_device_replaced().

If a device legitimately lacks Function 0, pci_get_slot() for PCI_DEVFN(0, 0)
will return NULL:

drivers/pci/hotplug/pciehp_hpc.c:pciehp_device_replaced() {
    ...
	pdev = pci_get_slot(ctrl->pcie->port->subordinate, PCI_DEVFN(0, 0));
	if (!pdev)
		return true;
    ...
}

Because it unconditionally returns true when Function 0 is absent, this false
replacement signal will trigger pci_walk_bus() to set the disconnected state
and queue a teardown request.

Could this spurious teardown issue be avoided by modifying
pciehp_device_replaced() to handle missing Function 0 devices correctly?

>  	pci_dev_put(dev);
>  
>   out:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012-pcie-hotplug-nullref-v1-1-6e21c2e89ea4@google.com?part=1