From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9749606A31C for ; Sun, 8 Nov 2026 14:18:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=ujjj1PIi; dkim=fail reason="signature verification failed" (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=H3JtE6+S DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Subject:Cc:To:From:Message-ID:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Unsubscribe-Post:List-Owner; bh=WxsDobmddu5AqOSJFl44ugpeatrTmoaxWhmRUEuMOKQ=; b=ujjj1PIi9AggtZyFTc6KMelh2r Y/Dp0ER3U+yltSV7tXyC0vqwSv0CCP3T0/MbFmblcm2pCxsK0QCEXrk69hmwyBDHtQ0DwaFj/Fetb a21lH+xAiWQhHDxmseCRqgeHAxHlvYsAH9WZMbCPkxJumMfHVzLbwh3a0J5TvQu3AAM8AfBdmnN9v 7hWUuIPSCqge3nsGbKcb9tNO7iQTGinp9ac6xPEaaiakeB1g/R0d+Di60GmwpHEqAxVV2WXk52Qo3 ZTeosv55N2RVRpCPNeQ3E1psmZ4znvjg5Gnr0I+st/M06r713TujKhl1m0UiaaHobfBjx/ndQ7JkG J8BBSdjQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.100.1 #2 (Red Hat Linux)) id 1xQ3j8-0000000GEvX-3qXI; Sun, 08 Nov 2026 14:18:34 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.100.1 #2 (Red Hat Linux)) id 1xQ3j8-0000000GEvK-0Dvo; Sun, 08 Nov 2026 14:18:34 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id D25D740D9A; Sun, 8 Nov 2026 14:18:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B0E3A1F0089F; Sun, 8 Nov 2026 14:18:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794147512; bh=ghvcB3Oep4ElkXVE3zWUAz9PnP9Knjes6ZFfb+9rHos=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=H3JtE6+SZAD59Z0SNA3Zvz10WdKGP+jyNoqW9bIBQrTLt+4IA5mHyHJpj2GCDQ+U2 0mF2z6afAXUx8O2tuJl35LCgByPldWzAqtQiIoByLOm8tfWL1zwmXLxVuo53PfbHu3 lJcaSibs7BCp+9QVB3dnoOGLLJLttv0SIQmdN6rGqhb+LkJ8VJiDxQkcrwQoHEJPiz vLIhaDUEleIe3Zfg718UGhfXyaq8gbnrQ11mMII9yu3RqMnicz2Oa6N9Nj4mj1ZCmE GHNhf4MJCtqtvUVOs65Y46ahDERPglOeB27qIaW9HUXTqcsY9zCJE3IZlCZj0tgSpp 5/kFsc2fFMn1A== Received: from sofa.misterjones.org ([185.219.108.64] helo=lobster-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xQ3j4-0000000Cpjj-2AGA; Sun, 08 Nov 2026 14:18:30 +0000 Date: Sun, 08 Nov 2026 14:21:53 +0000 Message-ID: <87mrrj8ku6.wl-maz@kernel.org> From: Marc Zyngier To: Hongyan Xu Cc: Bjorn Helgaas , linux-pci@vger.kernel.org, Daire McNamara , Conor Dooley , Robert Richter , Zhou Wang , Lorenzo Pieralisi , Krzysztof Wilczynski , Manivannan Sadhasivam , Rob Herring , linux-arm-kernel@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH 1/3] PCI: apple: Fix ECAM config window use-after-free In-Reply-To: <20261108105640.875-2-getshell@seu.edu.cn> References: <20261108105640.875-1-getshell@seu.edu.cn> <20261108105640.875-2-getshell@seu.edu.cn> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) X-Archived-By: MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: getshell@seu.edu.cn, bhelgaas@google.com, linux-pci@vger.kernel.org, daire.mcnamara@microchip.com, conor.dooley@microchip.com, rric@kernel.org, wangzhou1@hisilicon.com, lpieralisi@kernel.org, kwilczynski@kernel.org, mani@kernel.org, robh@kernel.org, linux-arm-kernel@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-riscv" X-Spam-Status: No, score=-3.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 On Sun, 08 Nov 2026 10:56:37 +0000, Hongyan Xu wrote: > > pcie-apple.c has no ->remove for pci_host_common_init(), so unbinding only > runs devres_release_all(): gen_pci_unmap_cfg() -> pci_ecam_free() frees the > ECAM config window while the bus tree stays registered - only > pci_remove_bus() unlinks a bus, and only pci_host_common_remove() reaches > it for a root bus. The next config access is a use-after-free in > pci_ecam_map_bus(), which reads cfg->ops->bus_shift. > Trigger: CONFIG_PCIE_APPLE=m; as root, one command: # rmmod apple_pcie > > Fix: add .remove = pci_host_common_remove, as pci-host-generic.c does since > commit 01fcb7f777a9 ("PCI: Add support for unbinding the generic PCI host > controller"), so pci_remove_root_bus() unlinks the bus before devres frees > cfg. Scope: cfg lifetime only; its IRQ handlers stay unreleased, so the > module is still unsafe to unload. Then this patch is pointless. Either you prevent the module from being unloaded, or you fully handle the removal. Any intermediate state is just churn. The former is easy enough to do, and gives you the basis to deal with the latter. Thanks, M. -- Jazz isn't dead. It just smells funny. _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv