[PATCH 1/9] PCI: cadence: Protect root bus removal with rescan lock

[Hans Zhang]

Calling pci_stop_root_bus() and pci_remove_root_bus() without holding
the PCI rescan lock may race with concurrent rescan or hotplug
operations triggered via sysfs, leading to use-after-free or system
crashes.

Add pci_lock_rescan_remove() before stopping/removing the root bus and
pci_unlock_rescan_remove() after in cdns_pcie_host_disable().

Signed-off-by: Hans Zhang <18255117159@xxxxxxx>
---
 drivers/pci/controller/cadence/pcie-cadence-host.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
index 0bc9e6e90e0e..87fd8afa301b 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -365,8 +365,10 @@ void cdns_pcie_host_disable(struct cdns_pcie_rc *rc)
 	struct pci_host_bridge *bridge;
 
 	bridge = pci_host_bridge_from_priv(rc);
+	pci_lock_rescan_remove();
 	pci_stop_root_bus(bridge->bus);
 	pci_remove_root_bus(bridge->bus);
+	pci_unlock_rescan_remove();
 
 	cdns_pcie_host_deinit(rc);
 	cdns_pcie_host_link_disable(rc);
-- 
2.34.1