Re: [PATCH 8/9] PCI: Enable async shutdown support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Double free and subsequent use-after-free of `bridge->dev` on `pci_register_host_bridge` error path.
--

commit 54e023865d6e2709d08edb15dbcb7e1249cfbfb7
Author: David Jeffery <djeffery@redhat.com>

PCI: Enable async shutdown support
    
Like its async suspend support, allow PCI device shutdown to be performed
asynchronously to reduce shutdown time.

> diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
> index 27008e2ea5afc..101a96718acd9 100644
> --- a/drivers/pci/probe.c
> +++ b/drivers/pci/probe.c
> @@ -1038,6 +1038,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
>  	if (err)
>  		goto free;
>  
> +	dev_set_async_shutdown(&bridge->dev);
>  	/* Temporarily move resources off the list */
>  	list_splice_init(&bridge->windows, &resources);
>  	err = device_add(&bridge->dev);

[Severity: Critical]
This isn't a bug introduced by this patch, but does the error handling path
for pci_register_host_bridge() have a double free and use-after-free of
bridge->dev?

If device_register(&bus->dev) fails later in this function, it jumps to
unregister:

drivers/pci/probe.c:pci_register_host_bridge() {
	...
unregister:
	put_device(&bridge->dev);
	device_del(&bridge->dev);
free:
	...
	if (bus_registered)
		put_device(&bus->dev);
}

The first explicit put_device(&bridge->dev) drops a reference to the
bridge. Then if bus_registered is true, it calls put_device(&bus->dev).

This triggers the bus release function release_pcibus_dev(), which
unconditionally drops a second reference to bridge->dev:

drivers/pci/probe.c:release_pcibus_dev() {
	...
	put_device(pci_bus->bridge);
	...
}

This drops the reference count of the bridge to 0, freeing the bridge object.

When pci_register_host_bridge() returns the error, callers like
pci_create_root_bus() will then try to drop their initial reference:

drivers/pci/probe.c:pci_create_root_bus() {
	...
err_out:
	put_device(&bridge->dev);
	...
}

Will this dereference the already freed bridge object, causing a
use-after-free and double free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902170734.95504-1-djeffery@redhat.com?part=8