Re: [PATCH 2/3] PCI: microchip: Fix ECAM config window use-after-free

[sashiko-bot@kernel.org]

> mc_host_probe() calls pci_host_common_probe() but has no ->remove, so an
> unbind only runs devres_release_all(): gen_pci_unmap_cfg() ->
> pci_ecam_free() frees the ECAM config window while the bus tree stays
> registered - only pci_remove_bus() unlinks a bus, and only
> pci_host_common_remove() reaches it for a root bus.  The next config access
> is a use-after-free in pci_ecam_map_bus(), which reads cfg->ops->bus_shift.
> Trigger: overlay rmdir in configfs, not rmmod (builtin_platform_driver()).
> 
> Fix: add .remove = pci_host_common_remove, as pci-host-generic.c does since
> commit 01fcb7f777a9 ("PCI: Add support for unbinding the generic PCI host
> controller"), so pci_remove_root_bus() unlinks the bus before devres frees
> cfg.  Scope: the PLDA IRQ domains it creates are not devres managed and
> stay unreleased - a separate, pre-existing issue.
> 
> Fixes: 6f15a9c9f941 ("PCI: microchip: Add Microchip PolarFire PCIe controller driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108105640.875-1-getshell@seu.edu.cn?part=2