Re: [PATCH v3] PCI: of_property: Omit bus properties without a subordinate bus

[Bjorn Helgaas]

On Fri, Sep 18, 2026 at 02:55:40PM -0500, Bjorn Helgaas wrote:
> Author: Angel J <iamanaws@xxxxxxxxx>
> 
> PCI: of_property: Omit bus properties without a subordinate bus
> 
> A bridge (a device with a Type 1 header) may not have a secondary bus
> allocated (pdev->subordinate), e.g., if there are no available bus numbers
> or the bridge secondary/subordinate bus numbers are not writable.
> 
> The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()
> dereference pdev->subordinate without checking it.  When
> CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer
> dereference and early boot hang.
> 
> Generate 'bus-range' and 'interrupt-map' properties only when a subordinate
> bus exists.  Keep the node and its remaining properties for bridges without
> one.
> 
> The problem was latent since 407d1a51921e ("PCI: Create device tree node
> for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create
> device tree PCI host bridge node"), which appeared in v6.15.  Before
> 1f340724419e, of_pci_make_dev_node() returned early because the parent OF
> node was missing.
> 
> Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
> Signed-off-by: Angel J <iamanaws@xxxxxxxxx>
> [bhelgaas: move pdev->subordinate test to callees, commit log]
> Signed-off-by: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx	# v6.6+
> Link: https://patch.msgid.link/20260912043106.10715-1-iamanaws@xxxxxxxxx

I put this on pci/for-linus, planning to be in v7.3, but I would love
to have testing reports to make sure it still works as the v2 does.

> ---
> Changes in v3:
> - Move pdev->subordinate tests to of_pci_prop_bus_range() and
>   of_pci_prop_intr_map()
> 
> Changes in v2
> (https://lore.kernel.org/all/20260912043106.10715-1-iamanaws@xxxxxxxxx):
> - Keep the dynamic OF node and skip only bus-range and interrupt-map
>   when no subordinate bus exists, following review of v1.
> - Tested on Linux 6.18.44 with the v1 guard removed.
> 
> v1
> (https://lore.kernel.org/all/20260911230420.26244-1-iamanaws@xxxxxxxxx)
> 
> diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
> index 75a358f73e69..1500740cc55d 100644
> --- a/drivers/pci/of_property.c
> +++ b/drivers/pci/of_property.c
> @@ -95,9 +95,13 @@ static int of_pci_prop_bus_range(struct pci_dev *pdev,
>  				 struct of_changeset *ocs,
>  				 struct device_node *np)
>  {
> -	u32 bus_range[] = { pdev->subordinate->busn_res.start,
> -			    pdev->subordinate->busn_res.end };
> +	u32 bus_range[2];
>  
> +	if (!pdev->subordinate)
> +		return 0;
> +
> +	bus_range[0] = pdev->subordinate->busn_res.start;
> +	bus_range[1] = pdev->subordinate->busn_res.end;
>  	return of_changeset_add_prop_u32_array(ocs, np, "bus-range", bus_range,
>  					       ARRAY_SIZE(bus_range));
>  }
> @@ -220,6 +224,9 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
>  	int ret;
>  	u8 pin;
>  
> +	if (!pdev->subordinate)
> +		return 0;
> +
>  	pnode = pci_device_to_OF_node(pdev->bus->self);
>  	if (!pnode)
>  		pnode = pci_bus_to_OF_node(pdev->bus);