From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794147513; b=uB4LF9wRBiUcY1gkX/SCSbCpgUYISsEcFKgrpRTjWhc5Ddm50XTN9zrso1M92+5Q4FTo QMdP//1TDbliocqADCeDj4szGU5GKQ5j6PTqEQj8EnTLkMJ1dGAKblsT6qxByZ5xO0NsL UdGMqno2JyQhMF/40NIv2p11UIOzYWu3aHsLMsKsJWbpdANPxcLClCptk8+SngcBp3twg 99NEes2pBBPx071pzBBqA83YD8WMDqpFjx17MKqlpV7GxBXZ+/bitrfK3QtezhE963rfQ Q2ZVkjbUuSeEh+jw2dlagj09eJdyFH9cw2YCNxNWYwyvepRE5bPLDPk7KXaHVQLOuiw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794147513; h=Received:DKIM-Signature:Received:Date:Message-ID:From:To:Cc:Subject: In-Reply-To:References:User-Agent:MIME-Version:Content-Type: X-SA-Exim-Connect-IP:X-SA-Exim-Rcpt-To:X-SA-Exim-Mail-From: X-SA-Exim-Scanned; bh=ghvcB3Oep4ElkXVE3zWUAz9PnP9Knjes6ZFfb+9rHos=; b=00Z0U8uG+O72qmeZevbw1sKqIE7c9ReklTQ0fj6kLoDJ1oHfR4OvtziN7gVBH9vqXzl+ kFZ192q+9/RIuGaDzvku3bUHRiD3Q1xiyTk5gsrmK+N5JJ0ZiDzMHXqqYLDHuBEDNrZD0 XomXf3zFpOxzWYVq41o9z8XWfRqSDxC8+EkAZpryDM9DA9Tz+KQUUlUMlBrBY1P29L+O2 AnuaWkPmlXdwPdxk+ULDIg5soeDETc+40mWVQbNtc9R5keC/Maxbxt0N7OzAFYlPLRDRj 9R9wuCTwOnO8RTE1Ximc48+9tXCWyayBOXhW9bZID647XX7GUiS8XsjHZ5dVPPUak+g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=H3JtE6+S; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36022606A334; Sun, 8 Nov 2026 14:18:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=H3JtE6+S Received: by smtp.kernel.org (Postfix) with ESMTPSA id B0E3A1F0089F; Sun, 8 Nov 2026 14:18:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794147512; bh=ghvcB3Oep4ElkXVE3zWUAz9PnP9Knjes6ZFfb+9rHos=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=H3JtE6+SZAD59Z0SNA3Zvz10WdKGP+jyNoqW9bIBQrTLt+4IA5mHyHJpj2GCDQ+U2 0mF2z6afAXUx8O2tuJl35LCgByPldWzAqtQiIoByLOm8tfWL1zwmXLxVuo53PfbHu3 lJcaSibs7BCp+9QVB3dnoOGLLJLttv0SIQmdN6rGqhb+LkJ8VJiDxQkcrwQoHEJPiz vLIhaDUEleIe3Zfg718UGhfXyaq8gbnrQ11mMII9yu3RqMnicz2Oa6N9Nj4mj1ZCmE GHNhf4MJCtqtvUVOs65Y46ahDERPglOeB27qIaW9HUXTqcsY9zCJE3IZlCZj0tgSpp 5/kFsc2fFMn1A== Received: from sofa.misterjones.org ([185.219.108.64] helo=lobster-girl.misterjones.org) by disco-boy.misterjones.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1xQ3j4-0000000Cpjj-2AGA; Sun, 08 Nov 2026 14:18:30 +0000 Date: Sun, 08 Nov 2026 14:21:53 +0000 Message-ID: <87mrrj8ku6.wl-maz@kernel.org> From: Marc Zyngier To: Hongyan Xu Cc: Bjorn Helgaas , linux-pci@vger.kernel.org, Daire McNamara , Conor Dooley , Robert Richter , Zhou Wang , Lorenzo Pieralisi , Krzysztof Wilczynski , Manivannan Sadhasivam , Rob Herring , linux-arm-kernel@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH 1/3] PCI: apple: Fix ECAM config window use-after-free In-Reply-To: <20261108105640.875-2-getshell@seu.edu.cn> References: <20261108105640.875-1-getshell@seu.edu.cn> <20261108105640.875-2-getshell@seu.edu.cn> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/30.1 (aarch64-unknown-linux-gnu) MULE/6.0 (HANACHIRUSATO) X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-SA-Exim-Connect-IP: 185.219.108.64 X-SA-Exim-Rcpt-To: getshell@seu.edu.cn, bhelgaas@google.com, linux-pci@vger.kernel.org, daire.mcnamara@microchip.com, conor.dooley@microchip.com, rric@kernel.org, wangzhou1@hisilicon.com, lpieralisi@kernel.org, kwilczynski@kernel.org, mani@kernel.org, robh@kernel.org, linux-arm-kernel@lists.infradead.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false On Sun, 08 Nov 2026 10:56:37 +0000, Hongyan Xu wrote: > > pcie-apple.c has no ->remove for pci_host_common_init(), so unbinding only > runs devres_release_all(): gen_pci_unmap_cfg() -> pci_ecam_free() frees the > ECAM config window while the bus tree stays registered - only > pci_remove_bus() unlinks a bus, and only pci_host_common_remove() reaches > it for a root bus. The next config access is a use-after-free in > pci_ecam_map_bus(), which reads cfg->ops->bus_shift. > Trigger: CONFIG_PCIE_APPLE=m; as root, one command: # rmmod apple_pcie > > Fix: add .remove = pci_host_common_remove, as pci-host-generic.c does since > commit 01fcb7f777a9 ("PCI: Add support for unbinding the generic PCI host > controller"), so pci_remove_root_bus() unlinks the bus before devres frees > cfg. Scope: cfg lifetime only; its IRQ handlers stay unreleased, so the > module is still unsafe to unload. Then this patch is pointless. Either you prevent the module from being unloaded, or you fully handle the removal. Any intermediate state is just churn. The former is easy enough to do, and gives you the basis to deal with the latter. Thanks, M. -- Jazz isn't dead. It just smells funny.