Re: [PATCH v3] PCI: of_property: Omit bus properties without a subordinate bus

[Angel J]

I didn't reply cuz I'm out for 3 weeks without access to that machine, so I can't test or confirm it works as expected (even though probably does)

Still, I will try to confirm as soon as I can.

Thanks

On Friday, September 18th, 2026 at 13:20, Bjorn Helgaas <helgaas@xxxxxxxxxx> wrote:

> On Fri, Sep 18, 2026 at 02:55:40PM -0500, Bjorn Helgaas wrote:
> > Author: Angel J <iamanaws@xxxxxxxxx>
> >
> > PCI: of_property: Omit bus properties without a subordinate bus
> >
> > A bridge (a device with a Type 1 header) may not have a secondary bus
> > allocated (pdev->subordinate), e.g., if there are no available bus numbers
> > or the bridge secondary/subordinate bus numbers are not writable.
> >
> > The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()
> > dereference pdev->subordinate without checking it.  When
> > CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer
> > dereference and early boot hang.
> >
> > Generate 'bus-range' and 'interrupt-map' properties only when a subordinate
> > bus exists.  Keep the node and its remaining properties for bridges without
> > one.
> >
> > The problem was latent since 407d1a51921e ("PCI: Create device tree node
> > for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create
> > device tree PCI host bridge node"), which appeared in v6.15.  Before
> > 1f340724419e, of_pci_make_dev_node() returned early because the parent OF
> > node was missing.
> >
> > Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
> > Signed-off-by: Angel J <iamanaws@xxxxxxxxx>
> > [bhelgaas: move pdev->subordinate test to callees, commit log]
> > Signed-off-by: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
> > Cc: stable@xxxxxxxxxxxxxxx	# v6.6+
> > Link: https://patch.msgid.link/20260912043106.10715-1-iamanaws@xxxxxxxxx
> 

> I put this on pci/for-linus, planning to be in v7.3, but I would love
> to have testing reports to make sure it still works as the v2 does.
> 

> > ---
> > Changes in v3:
> > - Move pdev->subordinate tests to of_pci_prop_bus_range() and
> >   of_pci_prop_intr_map()
> >
> > Changes in v2
> > (https://lore.kernel.org/all/20260912043106.10715-1-iamanaws@xxxxxxxxx):
> > - Keep the dynamic OF node and skip only bus-range and interrupt-map
> >   when no subordinate bus exists, following review of v1.
> > - Tested on Linux 6.18.44 with the v1 guard removed.
> >
> > v1
> > (https://lore.kernel.org/all/20260911230420.26244-1-iamanaws@xxxxxxxxx)
> >
> > diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
> > index 75a358f73e69..1500740cc55d 100644
> > --- a/drivers/pci/of_property.c
> > +++ b/drivers/pci/of_property.c
> > @@ -95,9 +95,13 @@ static int of_pci_prop_bus_range(struct pci_dev *pdev,
> >  				 struct of_changeset *ocs,
> >  				 struct device_node *np)
> >  {
> > -	u32 bus_range[] = { pdev->subordinate->busn_res.start,
> > -			    pdev->subordinate->busn_res.end };
> > +	u32 bus_range[2];
> >
> > +	if (!pdev->subordinate)
> > +		return 0;
> > +
> > +	bus_range[0] = pdev->subordinate->busn_res.start;
> > +	bus_range[1] = pdev->subordinate->busn_res.end;
> >  	return of_changeset_add_prop_u32_array(ocs, np, "bus-range", bus_range,
> >  					       ARRAY_SIZE(bus_range));
> >  }
> > @@ -220,6 +224,9 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
> >  	int ret;
> >  	u8 pin;
> >
> > +	if (!pdev->subordinate)
> > +		return 0;
> > +
> >  	pnode = pci_device_to_OF_node(pdev->bus->self);
> >  	if (!pnode)
> >  		pnode = pci_bus_to_OF_node(pdev->bus);
>

Attachment: signature.asc
Description: OpenPGP digital signature