Re: [PATCH 1/3] PCI: Fix NULL dereference when shrinking window without optional size

[sashiko-bot@kernel.org]

> adjust_bridge_window() assumes a bridge window it needs to shrink is on
> add_list. A window is only added to add_list when it has optional size
> or alignment. When resource distribution gives a window that is not on
> add_list less space than its required size, res_to_dev_res() returns NULL
> that is unconditionally dereferenced.
> 
> Consider a hotplug Root Port with no spare pref space and a switch below
> it with two non-hotplug Downstream Ports. 02:00.0 has a 2M pref BAR below
> it and 02:01.0 a 1M one. Alignment leaves only 1M of pref space for
> 02:00.0, and hot-add (emulated using a remove+rescan cycle) crashes in
> the inlined adjust_bridge_window():
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000030
>   RIP: 0010:pci_bus_distribute_available_resources+0x19b/0x4b0
>   Call Trace:
>    <TASK>
>    pci_bus_distribute_available_resources+0x468/0x4b0
>    pci_bus_distribute_available_resources+0x468/0x4b0
>    pci_bridge_distribute_available_resources+0x7a/0x90
>    pci_assign_unassigned_bridge_resources+0x43/0xe0
>    pci_rescan_bus_bridge_resize+0x23/0x40
>    bus_rescan_store+0x63/0x80
> 
> The required size must not be shrunk, so return early when the window
> has no optional size.
> 
> Fixes: dc4b4d04e1ca ("PCI: Prevent shrinking bridge window from its required size")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109144553.2516-1-ilpo.jarvinen@linux.intel.com?part=1