diff options
| author | Bjorn Helgaas <bhelgaas@google.com> | 2024-07-19 10:10:22 -0500 |
|---|---|---|
| committer | Bjorn Helgaas <bhelgaas@google.com> | 2024-07-19 10:10:22 -0500 |
| commit | 147ea50e1e0508544156b0465dc07fd8739281f4 (patch) | |
| tree | d9c866705bdeb745cbb853b735b66ad569df99a9 | |
| parent | 06bbe25c21a02ec09682be5077f22198870040e2 (diff) | |
| parent | 11a1f4bc47362700fcbde717292158873fb847ed (diff) | |
| download | lwn-147ea50e1e0508544156b0465dc07fd8739281f4.tar.gz lwn-147ea50e1e0508544156b0465dc07fd8739281f4.zip | |
Merge branch 'pci/dpc'
- If there's a device below a bridge, prevent a use-after-free by holding a
reference to the device while waiting for the secondary bus to be ready
in case the device is concurrently removed, e.g., by DPC (Lukas Wunner)
* pci/dpc:
PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
| -rw-r--r-- | drivers/pci/pci.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 632bfb048152..ef85cba4c8fb 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -4823,7 +4823,7 @@ static int pci_bus_max_d3cold_delay(const struct pci_bus *bus) */ int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type) { - struct pci_dev *child; + struct pci_dev *child __free(pci_dev_put) = NULL; int delay; if (pci_dev_is_disconnected(dev)) @@ -4852,8 +4852,8 @@ int pci_bridge_wait_for_secondary_bus(struct pci_dev *dev, char *reset_type) return 0; } - child = list_first_entry(&dev->subordinate->devices, struct pci_dev, - bus_list); + child = pci_dev_get(list_first_entry(&dev->subordinate->devices, + struct pci_dev, bus_list)); up_read(&pci_bus_sem); /* |