Re: [PATCH 1/3] PCI: apple: Fix ECAM config window use-after-free

[Marc Zyngier]

On Sun, 08 Nov 2026 10:56:37 +0000,
Hongyan Xu <getshell@xxxxxxxxxx> wrote:
> 
> pcie-apple.c has no ->remove for pci_host_common_init(), so unbinding only
> runs devres_release_all(): gen_pci_unmap_cfg() -> pci_ecam_free() frees the
> ECAM config window while the bus tree stays registered - only
> pci_remove_bus() unlinks a bus, and only pci_host_common_remove() reaches
> it for a root bus.  The next config access is a use-after-free in
> pci_ecam_map_bus(), which reads cfg->ops->bus_shift.
> Trigger: CONFIG_PCIE_APPLE=m; as root, one command: # rmmod apple_pcie
> 
> Fix: add .remove = pci_host_common_remove, as pci-host-generic.c does since
> commit 01fcb7f777a9 ("PCI: Add support for unbinding the generic PCI host
> controller"), so pci_remove_root_bus() unlinks the bus before devres frees
> cfg.  Scope: cfg lifetime only; its IRQ handlers stay unreleased, so the
> module is still unsafe to unload.

Then this patch is pointless. Either you prevent the module from being
unloaded, or you fully handle the removal. Any intermediate state is
just churn.

The former is easy enough to do, and gives you the basis to deal with
the latter.

Thanks,

	M.

-- 
Jazz isn't dead. It just smells funny.