Re: [PATCH v2 7/7] pci: fix UAF when probe runs concurrent to dyn ID removal

[Danilo Krummrich]

On Tue Jun 30, 2026 at 1:09 PM CEST, Gary Guo wrote:
> -static const struct pci_device_id *pci_match_device(struct pci_driver *drv,
> -						    struct pci_dev *dev)
> +static bool pci_match_device(struct pci_driver *drv,
> +			     struct pci_dev *dev,
> +			     struct pci_device_id *id)
>  {
>  	struct pci_dynid *dynid;
>  	const struct pci_device_id *found_id = NULL;
> @@ -196,30 +198,33 @@ static const struct pci_device_id *pci_match_device(struct pci_driver *drv,
>  	/* When driver_override is set, only bind to the matching driver */
>  	ret = device_match_driver_override(&dev->dev, &drv->driver);
>  	if (ret == 0)
> -		return NULL;
> +		return false;
>  
>  	dev_id = pci_id_from_device(dev);
>  	/* Look at the dynamic ids first, before the static ones */
> -	spin_lock(&drv->dynids.lock);
> -	list_for_each_entry(dynid, &drv->dynids.list, node) {
> -		if (pci_match_one_id(&dynid->id, &dev_id)) {
> -			found_id = &dynid->id;
> -			break;
> +	{
> +		guard(spinlock)(&drv->dynids.lock);
> +		list_for_each_entry(dynid, &drv->dynids.list, node) {
> +			if (pci_match_one_id(&dynid->id, &dev_id)) {
> +				*id = dynid->id;
> +				return true;
> +			}
>  		}
>  	}

Should be scoped_guard(spinlock, &drv->dynids.lock). It also looks like dynid
could be moved into the scoped_guard().