diff mbox series

[8/9] PCI: Enable async shutdown support

Message ID 20260902170734.95504-9-djeffery@redhat.com
State New
Headers show
Series shut down devices asynchronously | expand

Commit Message

David Jeffery Sept. 2, 2026, 5:07 p.m. UTC 
Like its async suspend support, allow PCI device shutdown to be performed
asynchronously to reduce shutdown time.

Signed-off-by: David Jeffery <djeffery@redhat.com>
Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
---
 drivers/pci/probe.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

sashiko-bot@kernel.org Sept. 2, 2026, 5:24 p.m. UTC | #1 
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Double free and subsequent use-after-free of `bridge->dev` on `pci_register_host_bridge` error path.
--

commit 54e023865d6e2709d08edb15dbcb7e1249cfbfb7
Author: David Jeffery <djeffery@redhat.com>

PCI: Enable async shutdown support
    
Like its async suspend support, allow PCI device shutdown to be performed
asynchronously to reduce shutdown time.

> diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
> index 27008e2ea5afc..101a96718acd9 100644
> --- a/drivers/pci/probe.c
> +++ b/drivers/pci/probe.c
> @@ -1038,6 +1038,7 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
>  	if (err)
>  		goto free;
>  
> +	dev_set_async_shutdown(&bridge->dev);
>  	/* Temporarily move resources off the list */
>  	list_splice_init(&bridge->windows, &resources);
>  	err = device_add(&bridge->dev);

[Severity: Critical]
This isn't a bug introduced by this patch, but does the error handling path
for pci_register_host_bridge() have a double free and use-after-free of
bridge->dev?

If device_register(&bus->dev) fails later in this function, it jumps to
unregister:

drivers/pci/probe.c:pci_register_host_bridge() {
	...
unregister:
	put_device(&bridge->dev);
	device_del(&bridge->dev);
free:
	...
	if (bus_registered)
		put_device(&bus->dev);
}

The first explicit put_device(&bridge->dev) drops a reference to the
bridge. Then if bus_registered is true, it calls put_device(&bus->dev).

This triggers the bus release function release_pcibus_dev(), which
unconditionally drops a second reference to bridge->dev:

drivers/pci/probe.c:release_pcibus_dev() {
	...
	put_device(pci_bus->bridge);
	...
}

This drops the reference count of the bridge to 0, freeing the bridge object.

When pci_register_host_bridge() returns the error, callers like
pci_create_root_bus() will then try to drop their initial reference:

drivers/pci/probe.c:pci_create_root_bus() {
	...
err_out:
	put_device(&bridge->dev);
	...
}

Will this dereference the already freed bridge object, causing a
use-after-free and double free?
diff mbox series

Patch

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 27008e2ea5af..101a96718acd 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1038,6 +1038,7 @@  static int pci_register_host_bridge(struct pci_host_bridge *bridge)
 	if (err)
 		goto free;
 
+	dev_set_async_shutdown(&bridge->dev);
 	/* Temporarily move resources off the list */
 	list_splice_init(&bridge->windows, &resources);
 	err = device_add(&bridge->dev);
@@ -2748,6 +2749,7 @@  void pci_device_add(struct pci_dev *dev, struct pci_bus *bus)
 	pci_reassigndev_resource_alignment(dev);
 
 	pci_init_capabilities(dev);
+	dev_set_async_shutdown(&dev->dev);
 
 	platform_pci_configure_wake(dev);