[PATCH v10 03/13] PCI: liveupdate: Track incoming preserved PCI devices

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] pci: liveupdate: silent DMA corruption risk on incoming device cleanup
--

commit 30099916ad0bce596acb2541018cac55703694d3
Author: David Matlack <dmatlack at google.com>

PCI: liveupdate: Track incoming preserved PCI devices

This commit adds tracking for incoming preserved PCI devices during Live
Update. It introduces pci_liveupdate_setup_device() to fetch the serialized
state from the previous kernel and marks devices as incoming-preserved until
drivers call pci_liveupdate_finish().

> diff --git a/drivers/pci/liveupdate.c b/drivers/pci/liveupdate.c
> index 22d5d177e104d..a1d9b2b1f9e38 100644
> --- a/drivers/pci/liveupdate.c
> +++ b/drivers/pci/liveupdate.c
[ ... ]
> @@ -382,7 +599,80 @@ void pci_liveupdate_cleanup_device(struct pci_dev *dev)
>  	 */
>  	if (READ_ONCE(dev->liveupdate.outgoing))
>  		pci_WARN(dev, 1, "Destroying outgoing-preserved device!\n");
> +
> +	if (READ_ONCE(dev->liveupdate.incoming))
> +		pci_WARN(dev, 1, "Destroying incoming-preserved device!\n");

[Severity: High]
Does this code risk silent memory corruption by only warning instead of
panicking?

When an incoming preserved device is destroyed, it is dropped from the
kernel's resource tracking. However, the device may still be live and
performing DMA if it was handed over by the previous kernel.

If this only warns, it allows the PCI core to proceed and potentially
reassign the device's bus numbers and MMIO resources to other devices while
the original device is still active. Although pci_check_all_devices_finished()
panics at the end of the Live Update session for unfinished devices, there is
a dangerous window where resource conflicts and DMA corruption can occur.

> +}
[ ... ]
> diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
> index 2a37e5d3e8e36..ad7fdf0d56b68 100644
> --- a/drivers/pci/probe.c
> +++ b/drivers/pci/probe.c
[ ... ]
> @@ -2188,6 +2190,7 @@ int pci_setup_device(struct pci_dev *dev)
>  	default:				    /* unknown header */
>  		pci_err(dev, "unknown header type %02x, ignoring device\n",
>  			dev->hdr_type);
> +		pci_liveupdate_cleanup_device(dev);

[Severity: High]
Can an incoming preserved device that fails enumeration here cause a resource
conflict?

If pci_setup_device() encounters an unknown header type for an incoming
device, it calls pci_liveupdate_cleanup_device() and ignores the device.
Since the cleanup routine only issues a warning, the live device is dropped
from tracking but might still be performing DMA.

>  		pci_release_of_node(dev);
>  		return -EIO;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013162529.1928093-1-dmatlack@google.com?part=3