[PATCH 0/9] PCI: controller: Add missing rescan lock around root bus removal

[PATCH 0/9] PCI: controller: Add missing rescan lock around root bus removal

[Hans Zhang]

Several PCIe host controller drivers call pci_stop_root_bus() and
pci_remove_root_bus() without holding the global PCI rescan lock
(pci_rescan_remove_global_lock). This can cause race conditions with
concurrent PCI rescan or hotplug operations triggered via sysfs,
potentially leading to use-after-free or system crashes.

This series adds the missing lock pairs to all drivers currently
exhibiting this pattern. No functional change other than proper
synchronization.

Each patch is independent and targets a specific controller driver.
Please review and apply.

---
The following are the comments from the sashiko-bot@kernel.org review.

https://lore.kernel.org/linux-pci/20260519132017.63E1BC2BCB3@smtp.kernel.org/
"""
> +void cdns_pcie_hpa_host_disable(struct cdns_pcie_rc *rc)
> +{
> +	struct pci_host_bridge *bridge;
> +
> +	cdns_pcie_debugfs_deinit(&rc->pcie);
> +	bridge = pci_host_bridge_from_priv(rc);
> +	pci_stop_root_bus(bridge->bus);
> +	pci_remove_root_bus(bridge->bus);
> +}

Could this lead to a race condition during root bus teardown?

Calling pci_stop_root_bus() and pci_remove_root_bus() without holding the
PCI rescan lock allows race conditions with concurrent PCI rescan or hotplug
operations triggered via sysfs.

While this pattern might have been copied from a pre-existing function like
cdns_pcie_host_disable(), does it need to be fixed here to prevent
use-after-free or system crashes?

Should these operations be protected by acquiring the lock using
pci_lock_rescan_remove() and pci_unlock_rescan_remove()?
"""


The function cdns_pcie_hpa_host_disable() mentioned in the bot's comment is from
a separate patch series and will be fixed independently. This series focuses only
on existing controller drivers in the mainline kernel.
---

Hans Zhang (9):
  PCI: cadence: Protect root bus removal with rescan lock
  PCI: dwc: Protect root bus removal with rescan lock
  PCI: altera: Protect root bus removal with rescan lock
  PCI: brcmstb: Protect root bus removal with rescan lock
  PCI: iproc: Protect root bus removal with rescan lock
  PCI: mediatek: Protect root bus removal with rescan lock
  PCI: rockchip: Protect root bus removal with rescan lock
  PCI: vmd: Protect root bus removal with rescan lock
  PCI: plda: Protect root bus removal with rescan lock

 drivers/pci/controller/cadence/pcie-cadence-host.c | 2 ++
 drivers/pci/controller/dwc/pcie-designware-host.c  | 2 ++
 drivers/pci/controller/pcie-altera.c               | 2 ++
 drivers/pci/controller/pcie-brcmstb.c              | 2 ++
 drivers/pci/controller/pcie-iproc.c                | 2 ++
 drivers/pci/controller/pcie-mediatek.c             | 2 ++
 drivers/pci/controller/pcie-rockchip-host.c        | 2 ++
 drivers/pci/controller/plda/pcie-plda-host.c       | 2 ++
 drivers/pci/controller/vmd.c                       | 2 ++
 9 files changed, 18 insertions(+)


base-commit: 6916d5703ddf9a38f1f6c2cc793381a24ee914c6
-- 
2.34.1

[PATCH 1/9] PCI: cadence: Protect root bus removal with rescan lock

[Hans Zhang]

Calling pci_stop_root_bus() and pci_remove_root_bus() without holding
the PCI rescan lock may race with concurrent rescan or hotplug
operations triggered via sysfs, leading to use-after-free or system
crashes.

Add pci_lock_rescan_remove() before stopping/removing the root bus and
pci_unlock_rescan_remove() after in cdns_pcie_host_disable().

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/cadence/pcie-cadence-host.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
index 0bc9e6e90e0e..87fd8afa301b 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -365,8 +365,10 @@ void cdns_pcie_host_disable(struct cdns_pcie_rc *rc)
 	struct pci_host_bridge *bridge;
 
 	bridge = pci_host_bridge_from_priv(rc);
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(bridge->bus);
 	pci_remove_root_bus(bridge->bus);
+	pci_unlock_rescan_remove();
 
 	cdns_pcie_host_deinit(rc);
 	cdns_pcie_host_link_disable(rc);
-- 
2.34.1

[PATCH 2/9] PCI: dwc: Protect root bus removal with rescan lock

[Hans Zhang]

Add pci_lock_rescan_remove() / pci_unlock_rescan_remove() around
pci_stop_root_bus() and pci_remove_root_bus() in dw_pcie_host_deinit()
to prevent race conditions with concurrent PCI rescan or hotplug.

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/dwc/pcie-designware-host.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index c9517a348836..f856ac2fb15d 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -703,8 +703,10 @@ void dw_pcie_host_deinit(struct dw_pcie_rp *pp)
 
 	dwc_pcie_debugfs_deinit(pci);
 
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(pp->bridge->bus);
 	pci_remove_root_bus(pp->bridge->bus);
+	pci_unlock_rescan_remove();
 
 	dw_pcie_stop_link(pci);
 
-- 
2.34.1

[PATCH 3/9] PCI: altera: Protect root bus removal with rescan lock

[Hans Zhang]

In altera_pcie_remove(), wrap pci_stop_root_bus() and
pci_remove_root_bus() with pci_lock_rescan_remove() /
pci_unlock_rescan_remove() to avoid potential races with
sysfs-triggered rescans.

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/pcie-altera.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/pcie-altera.c b/drivers/pci/controller/pcie-altera.c
index 3dbb7adc421c..7e1db267ae34 100644
--- a/drivers/pci/controller/pcie-altera.c
+++ b/drivers/pci/controller/pcie-altera.c
@@ -1045,8 +1045,10 @@ static void altera_pcie_remove(struct platform_device *pdev)
 	struct altera_pcie *pcie = platform_get_drvdata(pdev);
 	struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
 
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(bridge->bus);
 	pci_remove_root_bus(bridge->bus);
+	pci_unlock_rescan_remove();
 	altera_pcie_irq_teardown(pcie);
 }
 
-- 
2.34.1

[PATCH 4/9] PCI: brcmstb: Protect root bus removal with rescan lock

[Hans Zhang]

Add missing PCI rescan lock protection in brcm_pcie_remove() before
removing the root bus.

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/pcie-brcmstb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index 714bcab97b60..7ca27f0756c9 100644
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -1894,8 +1894,10 @@ static void brcm_pcie_remove(struct platform_device *pdev)
 	struct brcm_pcie *pcie = platform_get_drvdata(pdev);
 	struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
 
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(bridge->bus);
 	pci_remove_root_bus(bridge->bus);
+	pci_unlock_rescan_remove();
 	if (pcie->cfg->has_err_report)
 		brcm_unregister_die_notifiers(pcie);
 
-- 
2.34.1

[PATCH 5/9] PCI: iproc: Protect root bus removal with rescan lock

[Hans Zhang]

Hold pci_rescan_remove_global_lock during root bus stop and
removal in iproc_pcie_remove().

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/pcie-iproc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
index ccf71993ea35..c8f0a87cf28a 100644
--- a/drivers/pci/controller/pcie-iproc.c
+++ b/drivers/pci/controller/pcie-iproc.c
@@ -1529,8 +1529,10 @@ void iproc_pcie_remove(struct iproc_pcie *pcie)
 {
 	struct pci_host_bridge *host = pci_host_bridge_from_priv(pcie);
 
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(host->bus);
 	pci_remove_root_bus(host->bus);
+	pci_unlock_rescan_remove();
 
 	iproc_pcie_msi_disable(pcie);
 
-- 
2.34.1

[PATCH 6/9] PCI: mediatek: Protect root bus removal with rescan lock

[Hans Zhang]

Secure mtk_pcie_remove() by adding pci_lock_rescan_remove() /
pci_unlock_rescan_remove() around pci_stop_root_bus() and
pci_remove_root_bus().

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/pcie-mediatek.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index 75722524fe74..2fedb6d2939d 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -1172,8 +1172,10 @@ static void mtk_pcie_remove(struct platform_device *pdev)
 	struct mtk_pcie *pcie = platform_get_drvdata(pdev);
 	struct pci_host_bridge *host = pci_host_bridge_from_priv(pcie);
 
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(host->bus);
 	pci_remove_root_bus(host->bus);
+	pci_unlock_rescan_remove();
 	mtk_pcie_free_resources(pcie);
 
 	mtk_pcie_irq_teardown(pcie);
-- 
2.34.1

[PATCH 7/9] PCI: rockchip: Protect root bus removal with rescan lock

[Hans Zhang]

In rockchip_pcie_remove(), use PCI rescan lock to serialize root bus
deletion against concurrent bus rescan operations.

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/pcie-rockchip-host.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/pcie-rockchip-host.c b/drivers/pci/controller/pcie-rockchip-host.c
index ee1822ca01db..d203c4876d30 100644
--- a/drivers/pci/controller/pcie-rockchip-host.c
+++ b/drivers/pci/controller/pcie-rockchip-host.c
@@ -1012,8 +1012,10 @@ static void rockchip_pcie_remove(struct platform_device *pdev)
 	struct rockchip_pcie *rockchip = dev_get_drvdata(dev);
 	struct pci_host_bridge *bridge = pci_host_bridge_from_priv(rockchip);
 
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(bridge->bus);
 	pci_remove_root_bus(bridge->bus);
+	pci_unlock_rescan_remove();
 	irq_domain_remove(rockchip->irq_domain);
 
 	rockchip_pcie_deinit_phys(rockchip);
-- 
2.34.1

[PATCH 8/9] PCI: vmd: Protect root bus removal with rescan lock

[Hans Zhang]

Hold pci_rescan_remove_global_lock while stopping and removing the VMD
root bus in vmd_remove() to prevent races with PCI rescan operations.

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/vmd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
index d4ae250d4bc6..9565567026cf 100644
--- a/drivers/pci/controller/vmd.c
+++ b/drivers/pci/controller/vmd.c
@@ -1056,9 +1056,11 @@ static void vmd_remove(struct pci_dev *dev)
 {
 	struct vmd_dev *vmd = pci_get_drvdata(dev);
 
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(vmd->bus);
 	sysfs_remove_link(&vmd->dev->dev.kobj, "domain");
 	pci_remove_root_bus(vmd->bus);
+	pci_unlock_rescan_remove();
 	vmd_cleanup_srcu(vmd);
 	vmd_detach_resources(vmd);
 	vmd_remove_irq_domain(vmd);
-- 
2.34.1

[PATCH 9/9] PCI: plda: Protect root bus removal with rescan lock

[Hans Zhang]

Add missing lock acquisition in plda_pcie_host_deinit() before
stopping/removing the root bus.

Signed-off-by: Hans Zhang <18255117159@163.com>
---
 drivers/pci/controller/plda/pcie-plda-host.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/plda/pcie-plda-host.c b/drivers/pci/controller/plda/pcie-plda-host.c
index 3c2f68383010..f9a34f323ad8 100644
--- a/drivers/pci/controller/plda/pcie-plda-host.c
+++ b/drivers/pci/controller/plda/pcie-plda-host.c
@@ -640,8 +640,10 @@ EXPORT_SYMBOL_GPL(plda_pcie_host_init);
 
 void plda_pcie_host_deinit(struct plda_pcie_rp *port)
 {
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(port->bridge->bus);
 	pci_remove_root_bus(port->bridge->bus);
+	pci_unlock_rescan_remove();
 
 	plda_pcie_irq_domain_deinit(port);
 
-- 
2.34.1

Re: (subset) [PATCH 0/9] PCI: controller: Add missing rescan lock around root bus removal

[Manivannan Sadhasivam]

On Fri, 22 May 2026 00:18:13 +0800, Hans Zhang wrote:
> Several PCIe host controller drivers call pci_stop_root_bus() and
> pci_remove_root_bus() without holding the global PCI rescan lock
> (pci_rescan_remove_global_lock). This can cause race conditions with
> concurrent PCI rescan or hotplug operations triggered via sysfs,
> potentially leading to use-after-free or system crashes.
> 
> This series adds the missing lock pairs to all drivers currently
> exhibiting this pattern. No functional change other than proper
> synchronization.
> 
> [...]

Applied, thanks!

[1/9] PCI: cadence: Protect root bus removal with rescan lock
      commit: 3bc5dbef170b1f715f13102fce22a5db921f893a
[2/9] PCI: dwc: Protect root bus removal with rescan lock
      commit: f47cc36e63dc9b8f20c3404c701a7aed105938a2
[3/9] PCI: altera: Protect root bus removal with rescan lock
      commit: e2557f2705760101e794ba32a08586b2ab35deb2
[4/9] PCI: brcmstb: Protect root bus removal with rescan lock
      commit: 435c29e2af6aeaf1e115db179020ef0869cfd205
[5/9] PCI: iproc: Protect root bus removal with rescan lock
      commit: 95cb96f6693ffc59a620379d74ab6f0efe65218b
[6/9] PCI: mediatek: Protect root bus removal with rescan lock
      commit: abd23e96d429551f92febd7f5d4a9a63d75c5f74
[7/9] PCI: rockchip: Protect root bus removal with rescan lock
      commit: f4e77bd57d9bf799bdfc125644838918128c0537
[9/9] PCI: plda: Protect root bus removal with rescan lock
      commit: e94a7411ee6d3c81039e960e9c92dcee03699031

Best regards,
-- 
Manivannan Sadhasivam <mani@kernel.org>

Re: [PATCH 0/9] PCI: controller: Add missing rescan lock around root bus removal

[Bjorn Helgaas]

On Fri, May 22, 2026 at 12:18:13AM +0800, Hans Zhang wrote:
> Several PCIe host controller drivers call pci_stop_root_bus() and
> pci_remove_root_bus() without holding the global PCI rescan lock
> (pci_rescan_remove_global_lock). This can cause race conditions with
> concurrent PCI rescan or hotplug operations triggered via sysfs,
> potentially leading to use-after-free or system crashes.
> 
> This series adds the missing lock pairs to all drivers currently
> exhibiting this pattern. No functional change other than proper
> synchronization.
> 
> Each patch is independent and targets a specific controller driver.
> Please review and apply.

Thanks for this work.  I amended the commit logs of the eight applied
patches so they're all the same (since all the patches do exactly the
same thing) and so they all mention the reason for the change.

There are only four callers of pci_stop_root_bus() and
pci_remove_root_bus() that would not be able to use a trivial helper
function that does the lock/stop/remove/unlock internally:

  zpci_bus_release
  acpi_pci_root_remove
  hv_pci_remove
  vmd_remove

It would be nice to analyze those to see if they could use the same
pattern, which could be done inside a helper function that would avoid
the possibility of adding the same bug elsewhere.

> ---
> The following are the comments from the sashiko-bot@kernel.org review.
> 
> https://lore.kernel.org/linux-pci/20260519132017.63E1BC2BCB3@smtp.kernel.org/
> """
> > +void cdns_pcie_hpa_host_disable(struct cdns_pcie_rc *rc)
> > +{
> > +	struct pci_host_bridge *bridge;
> > +
> > +	cdns_pcie_debugfs_deinit(&rc->pcie);
> > +	bridge = pci_host_bridge_from_priv(rc);
> > +	pci_stop_root_bus(bridge->bus);
> > +	pci_remove_root_bus(bridge->bus);
> > +}
> 
> Could this lead to a race condition during root bus teardown?
> 
> Calling pci_stop_root_bus() and pci_remove_root_bus() without holding the
> PCI rescan lock allows race conditions with concurrent PCI rescan or hotplug
> operations triggered via sysfs.
> 
> While this pattern might have been copied from a pre-existing function like
> cdns_pcie_host_disable(), does it need to be fixed here to prevent
> use-after-free or system crashes?
> 
> Should these operations be protected by acquiring the lock using
> pci_lock_rescan_remove() and pci_unlock_rescan_remove()?
> """
> 
> 
> The function cdns_pcie_hpa_host_disable() mentioned in the bot's comment is from
> a separate patch series and will be fixed independently. This series focuses only
> on existing controller drivers in the mainline kernel.
> ---
> 
> Hans Zhang (9):
>   PCI: cadence: Protect root bus removal with rescan lock
>   PCI: dwc: Protect root bus removal with rescan lock
>   PCI: altera: Protect root bus removal with rescan lock
>   PCI: brcmstb: Protect root bus removal with rescan lock
>   PCI: iproc: Protect root bus removal with rescan lock
>   PCI: mediatek: Protect root bus removal with rescan lock
>   PCI: rockchip: Protect root bus removal with rescan lock
>   PCI: vmd: Protect root bus removal with rescan lock
>   PCI: plda: Protect root bus removal with rescan lock
> 
>  drivers/pci/controller/cadence/pcie-cadence-host.c | 2 ++
>  drivers/pci/controller/dwc/pcie-designware-host.c  | 2 ++
>  drivers/pci/controller/pcie-altera.c               | 2 ++
>  drivers/pci/controller/pcie-brcmstb.c              | 2 ++
>  drivers/pci/controller/pcie-iproc.c                | 2 ++
>  drivers/pci/controller/pcie-mediatek.c             | 2 ++
>  drivers/pci/controller/pcie-rockchip-host.c        | 2 ++
>  drivers/pci/controller/plda/pcie-plda-host.c       | 2 ++
>  drivers/pci/controller/vmd.c                       | 2 ++
>  9 files changed, 18 insertions(+)
> 
> 
> base-commit: 6916d5703ddf9a38f1f6c2cc793381a24ee914c6
> -- 
> 2.34.1
> 

Re: [PATCH 0/9] PCI: controller: Add missing rescan lock around root bus removal

[Hans Zhang]

On 6/19/26 00:59, Bjorn Helgaas wrote:
> On Fri, May 22, 2026 at 12:18:13AM +0800, Hans Zhang wrote:
>> Several PCIe host controller drivers call pci_stop_root_bus() and
>> pci_remove_root_bus() without holding the global PCI rescan lock
>> (pci_rescan_remove_global_lock). This can cause race conditions with
>> concurrent PCI rescan or hotplug operations triggered via sysfs,
>> potentially leading to use-after-free or system crashes.
>>
>> This series adds the missing lock pairs to all drivers currently
>> exhibiting this pattern. No functional change other than proper
>> synchronization.
>>
>> Each patch is independent and targets a specific controller driver.
>> Please review and apply.
> 
> Thanks for this work.  I amended the commit logs of the eight applied
> patches so they're all the same (since all the patches do exactly the
> same thing) and so they all mention the reason for the change.
> 
> There are only four callers of pci_stop_root_bus() and
> pci_remove_root_bus() that would not be able to use a trivial helper
> function that does the lock/stop/remove/unlock internally:
> 
>    zpci_bus_release
>    acpi_pci_root_remove
>    hv_pci_remove
>    vmd_remove
> 
> It would be nice to analyze those to see if they could use the same
> pattern, which could be done inside a helper function that would avoid
> the possibility of adding the same bug elsewhere.
> 

Hi Bjorn,

Thank you for reviewing the series and for the constructive suggestion
regarding the common helper function.

I fully agree that introducing a helper (e.g., pci_remove_root_bus_safe())
to encapsulate the lock/unlock logic is a cleaner and more maintainable
approach, and it would help prevent similar issues in the future.

Since we are now in the merge window, I would prefer to hold off on this
further refactoring until the next cycle to avoid introducing any
unnecessary risks or conflicts at this late stage.

Best regards,
Hans

>> ---
>> The following are the comments from the sashiko-bot@kernel.org review.
>>
>> https://lore.kernel.org/linux-pci/20260519132017.63E1BC2BCB3@smtp.kernel.org/
>> """
>>> +void cdns_pcie_hpa_host_disable(struct cdns_pcie_rc *rc)
>>> +{
>>> +	struct pci_host_bridge *bridge;
>>> +
>>> +	cdns_pcie_debugfs_deinit(&rc->pcie);
>>> +	bridge = pci_host_bridge_from_priv(rc);
>>> +	pci_stop_root_bus(bridge->bus);
>>> +	pci_remove_root_bus(bridge->bus);
>>> +}
>>
>> Could this lead to a race condition during root bus teardown?
>>
>> Calling pci_stop_root_bus() and pci_remove_root_bus() without holding the
>> PCI rescan lock allows race conditions with concurrent PCI rescan or hotplug
>> operations triggered via sysfs.
>>
>> While this pattern might have been copied from a pre-existing function like
>> cdns_pcie_host_disable(), does it need to be fixed here to prevent
>> use-after-free or system crashes?
>>
>> Should these operations be protected by acquiring the lock using
>> pci_lock_rescan_remove() and pci_unlock_rescan_remove()?
>> """
>>
>>
>> The function cdns_pcie_hpa_host_disable() mentioned in the bot's comment is from
>> a separate patch series and will be fixed independently. This series focuses only
>> on existing controller drivers in the mainline kernel.
>> ---
>>
>> Hans Zhang (9):
>>    PCI: cadence: Protect root bus removal with rescan lock
>>    PCI: dwc: Protect root bus removal with rescan lock
>>    PCI: altera: Protect root bus removal with rescan lock
>>    PCI: brcmstb: Protect root bus removal with rescan lock
>>    PCI: iproc: Protect root bus removal with rescan lock
>>    PCI: mediatek: Protect root bus removal with rescan lock
>>    PCI: rockchip: Protect root bus removal with rescan lock
>>    PCI: vmd: Protect root bus removal with rescan lock
>>    PCI: plda: Protect root bus removal with rescan lock
>>
>>   drivers/pci/controller/cadence/pcie-cadence-host.c | 2 ++
>>   drivers/pci/controller/dwc/pcie-designware-host.c  | 2 ++
>>   drivers/pci/controller/pcie-altera.c               | 2 ++
>>   drivers/pci/controller/pcie-brcmstb.c              | 2 ++
>>   drivers/pci/controller/pcie-iproc.c                | 2 ++
>>   drivers/pci/controller/pcie-mediatek.c             | 2 ++
>>   drivers/pci/controller/pcie-rockchip-host.c        | 2 ++
>>   drivers/pci/controller/plda/pcie-plda-host.c       | 2 ++
>>   drivers/pci/controller/vmd.c                       | 2 ++
>>   9 files changed, 18 insertions(+)
>>
>>
>> base-commit: 6916d5703ddf9a38f1f6c2cc793381a24ee914c6
>> -- 
>> 2.34.1
>>

Re: [PATCH 0/9] PCI: controller: Add missing rescan lock around root bus removal

[Bjorn Helgaas]

On Fri, Jun 19, 2026 at 11:20:33PM +0800, Hans Zhang wrote:
> On 6/19/26 00:59, Bjorn Helgaas wrote:
> > On Fri, May 22, 2026 at 12:18:13AM +0800, Hans Zhang wrote:
> > > Several PCIe host controller drivers call pci_stop_root_bus() and
> > > pci_remove_root_bus() without holding the global PCI rescan lock
> > > (pci_rescan_remove_global_lock). This can cause race conditions with
> > > concurrent PCI rescan or hotplug operations triggered via sysfs,
> > > potentially leading to use-after-free or system crashes.
> ...

> > Thanks for this work.  I amended the commit logs of the eight applied
> > patches so they're all the same (since all the patches do exactly the
> > same thing) and so they all mention the reason for the change.
> > 
> > There are only four callers of pci_stop_root_bus() and
> > pci_remove_root_bus() that would not be able to use a trivial helper
> > function that does the lock/stop/remove/unlock internally:
> > 
> >    zpci_bus_release
> >    acpi_pci_root_remove
> >    hv_pci_remove
> >    vmd_remove
> > 
> > It would be nice to analyze those to see if they could use the same
> > pattern, which could be done inside a helper function that would avoid
> > the possibility of adding the same bug elsewhere.
> 
> Thank you for reviewing the series and for the constructive suggestion
> regarding the common helper function.
> 
> I fully agree that introducing a helper (e.g., pci_remove_root_bus_safe())
> to encapsulate the lock/unlock logic is a cleaner and more maintainable
> approach, and it would help prevent similar issues in the future.
> 
> Since we are now in the merge window, I would prefer to hold off on this
> further refactoring until the next cycle to avoid introducing any
> unnecessary risks or conflicts at this late stage.

Definitely.  This series is already merged, so this is just potential
future work.  I'm not sure I would even add such a helper unless those
last four cases (zpci, acpi, etc) could also use it.  Having two
patterns would be only a marginal benefit.