Re: [PATCH v11 10/10] PCI: of: Avoid np->data usage for the node changeset

Hi All,

On Wed,  9 Sep 2026 10:01:09 +0200
Herve Codina [off-list ref] wrote:

of_pci_remove_node() and of_pci_remove_host_bridge_node() check
whether the node is dynamic but not whether it has valid private data.

During the node creation, an OF changeset is used and this changeset is
stored in np->data to be available for removal functions.

If, for instance, a PCI host bridge is created using a device-tree
overlay, the related node will have the dynamic flag set but np->data
will be NULL. This leads to NULL pointer dereferences.

Checking for a non-NULL np->data pointer to determine if the node has
been created by the PCI node creation process is not enough. Indeed,
on some platforms like PowerPC, the OF_RECONFIG_ATTACH_NODE notifier
(e.g., in the pci_dn_reconfig_notifier() function) intercepts node
additions and populates np->data with its own structure, such as a
struct pci_dn. In that case, np->data is not NULL but it is not related
to our changeset stored during the PCI node process creation.

Avoid the usage of np->data to store the changeset used during the PCI
node creation. Store our changeset in a more relevant structure: either
struct pci_dev when the node is created for a PCI device or struct
pci_host_bridge when the node is created for the PCI host bridge.

With that done, no ambiguity remains on removal. Indeed, this changeset,
if non-NULL, is the one used during PCI node creation. Check and use
this changeset on the removal process.

Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
Fixes: 1f340724419e ("PCI: of: Create device tree PCI host bridge node")
Cc: <stable+noautosel@kernel.org> # Issue not triggered but could be a problem
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
---
 drivers/pci/of.c    | 28 ++++++++++++++--------------
 include/linux/pci.h | 11 +++++++++++
 2 files changed, 25 insertions(+), 14 deletions(-)

Shashiko has reported issues [0].

IMO, those issues cannot be triggered but I would like to know the opinion of
other people and Maintainers.

Of course, I can update the code to more defensive but is it really needed?

Let me know if I need to send a new iteration with the update (check for a
null np and set cset to NULL after the kfree() call in remove functions).

[0] https://lore.kernel.org/all/20260909110623.2e6bbc89@bootlin.com/ (local)

Best regards,
Hervé