[PATCH] PCI: pciehp: Make poll mode parameter read-only

[PATCH] PCI: pciehp: Make poll mode parameter read-only

[Runyu Xiao]

pciehp_request_irq() and pciehp_free_irq() select different resources
based on the global pciehp_poll_mode parameter. The parameter is
currently writable through sysfs, so changing it while a controller is
active can make teardown stop a nonexistent polling thread or call
free_irq() for an IRQ that was not requested.

Keep the parameter available for boot and module configuration, but
prevent runtime changes to the registration mode.

Reproducer:
Boot an x86_64 guest in QEMU with a native PCIe hotplug root port and an
e1000 device, using these device options:

    -device pcie-root-port,id=rp1,chassis=1,slot=1
    -device e1000,bus=rp1

Pass pcie_ports=native pciehp.pciehp_poll_mode=1 to the guest kernel.
As root in the guest, replace the device name below with a bound pciehp
service device and run:

    dev=0000:00:1c.0:pcie004
    driver=/sys/bus/pci_express/drivers/pciehp
    echo 0 > /sys/module/pciehp/parameters/poll_mode
    echo "$dev" > "$driver/unbind"
    dmesg | grep 'Trying to free already-free IRQ'

The unfixed kernel accepts the runtime mode change and reports the warning
when the service device is removed. The fixed kernel rejects the write and
removes the device without the warning. The mode change is a deliberate
privileged test action and is not expected during ordinary operation.

Fixes: 2aeeef119995 ("pciehp: Clean up pcie_init()")
Cc: stable@vger.kernel.org
Assisted-by: LLM Codex
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/pci/hotplug/pciehp_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index 2cafd3b26f344..5ce32dc7e178f 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -38,7 +38,7 @@ int pciehp_poll_time;
  * not really modular, but the easiest way to keep compat with existing
  * bootargs behaviour is to continue using module_param here.
  */
-module_param(pciehp_poll_mode, bool, 0644);
+module_param(pciehp_poll_mode, bool, 0444);
 module_param(pciehp_poll_time, int, 0644);
 MODULE_PARM_DESC(pciehp_poll_mode, "Using polling mechanism for hot-plug events or not");
 MODULE_PARM_DESC(pciehp_poll_time, "Polling mechanism frequency, in seconds");
-- 
2.34.1

Re: [PATCH] PCI: pciehp: Make poll mode parameter read-only

[Lukas Wunner]

On Mon, Sep 21, 2026 at 10:26:08PM +0800, Runyu Xiao wrote:
> pciehp_request_irq() and pciehp_free_irq() select different resources
> based on the global pciehp_poll_mode parameter. The parameter is
> currently writable through sysfs, so changing it while a controller is
> active can make teardown stop a nonexistent polling thread or call
> free_irq() for an IRQ that was not requested.
> 
> Keep the parameter available for boot and module configuration, but
> prevent runtime changes to the registration mode.
[...]
> Fixes: 2aeeef119995 ("pciehp: Clean up pcie_init()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM Codex
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Reviewed-by: Lukas Wunner <lukas@wunner.de>

The Fixes tag looks odd to me because the module_param has existed
before the tree was even converted to git, as has the irq usage.
I'd just drop the Fixes tag and use only the stable designation.

Thanks,

Lukas

Re: [PATCH] PCI: pciehp: Make poll mode parameter read-only

[Bjorn Helgaas]

On Mon, Sep 21, 2026 at 10:26:08PM +0800, Runyu Xiao wrote:
> pciehp_request_irq() and pciehp_free_irq() select different resources
> based on the global pciehp_poll_mode parameter. The parameter is
> currently writable through sysfs, so changing it while a controller is
> active can make teardown stop a nonexistent polling thread or call
> free_irq() for an IRQ that was not requested.
> 
> Keep the parameter available for boot and module configuration, but
> prevent runtime changes to the registration mode.
> 
> Reproducer:
> Boot an x86_64 guest in QEMU with a native PCIe hotplug root port and an
> e1000 device, using these device options:
> 
>     -device pcie-root-port,id=rp1,chassis=1,slot=1
>     -device e1000,bus=rp1
> 
> Pass pcie_ports=native pciehp.pciehp_poll_mode=1 to the guest kernel.
> As root in the guest, replace the device name below with a bound pciehp
> service device and run:
> 
>     dev=0000:00:1c.0:pcie004
>     driver=/sys/bus/pci_express/drivers/pciehp
>     echo 0 > /sys/module/pciehp/parameters/poll_mode
>     echo "$dev" > "$driver/unbind"
>     dmesg | grep 'Trying to free already-free IRQ'
> 
> The unfixed kernel accepts the runtime mode change and reports the warning
> when the service device is removed. The fixed kernel rejects the write and
> removes the device without the warning. The mode change is a deliberate
> privileged test action and is not expected during ordinary operation.
> 
> Fixes: 2aeeef119995 ("pciehp: Clean up pcie_init()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM Codex
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>

Applied to pci/hotplug for v7.4, thanks!

> ---
>  drivers/pci/hotplug/pciehp_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
> index 2cafd3b26f344..5ce32dc7e178f 100644
> --- a/drivers/pci/hotplug/pciehp_core.c
> +++ b/drivers/pci/hotplug/pciehp_core.c
> @@ -38,7 +38,7 @@ int pciehp_poll_time;
>   * not really modular, but the easiest way to keep compat with existing
>   * bootargs behaviour is to continue using module_param here.
>   */
> -module_param(pciehp_poll_mode, bool, 0644);
> +module_param(pciehp_poll_mode, bool, 0444);
>  module_param(pciehp_poll_time, int, 0644);
>  MODULE_PARM_DESC(pciehp_poll_mode, "Using polling mechanism for hot-plug events or not");
>  MODULE_PARM_DESC(pciehp_poll_time, "Polling mechanism frequency, in seconds");
> -- 
> 2.34.1
>