PCI: Check parent kobject in pci_destroy_dev()

rafaeljw · bjorn-helgaas · commit 8a4c5c329de7 · 2014-01-15T10:34:13.000-07:00
If pci_stop_and_remove_bus_device() is run concurrently for a device and
its parent bridge via remove_callback(), both code paths attempt to acquire
pci_rescan_remove_lock.  If the child device removal acquires it first,
there will be no problems.  However, if the parent bridge removal acquires
it first, it will eventually execute pci_destroy_dev() for the child
device, but that device object will not be freed yet due to the reference
held by the concurrent child removal.  Consequently, both
pci_stop_bus_device() and pci_remove_bus_device() will be executed for that
device unnecessarily and pci_destroy_dev() will see a corrupted list head
in that object.  Moreover, an excess put_device() will be executed for that
device in that case which may lead to a use-after-free in the final
kobject_put() done by sysfs_schedule_callback_work().

To avoid that problem, make pci_destroy_dev() check if the device's parent
kobject is NULL, which only happens after device_del() has already run for
it.  Make pci_destroy_dev() return immediately whithout doing anything in
that case.

Signed-off-by: Rafael J. Wysocki &lt;rafael.j.wysocki@intel.com&gt;
Signed-off-by: Bjorn Helgaas &lt;bhelgaas@google.com&gt;
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
@@ -20,6 +20,9 @@ static void pci_stop_dev(struct pci_dev *dev)
 
 static void pci_destroy_dev(struct pci_dev *dev)
 {
+	if (!dev->dev.kobj.parent)
+		return;
+
 	device_del(&dev->dev);
 
 	put_device(&dev->dev);

Original file line number	Diff line number	Diff line change
`@@ -20,6 +20,9 @@ static void pci_stop_dev(struct pci_dev *dev)`
`20`	`20`
`21`	`21`	`static void pci_destroy_dev(struct pci_dev *dev)`
`22`	`22`	`{`
	`23`	`+ if (!dev->dev.kobj.parent)`
	`24`	`+ return;`
	`25`	`+`
`23`	`26`	`device_del(&dev->dev);`
`24`	`27`
`25`	`28`	`put_device(&dev->dev);`