[PATCH 0/3] PCI: Fix ECAM config window use-after-free in five drivers

[Hongyan Xu]

Five PCI host controller drivers use pci_host_common_probe() or
pci_host_common_init() but install no ->remove, so unbinding frees the ECAM
config window through devres while the bus tree is still registered, and
the next config space access is a use-after-free.

Patch 1/3 is the apple driver.  CONFIG_PCIE_APPLE=m plus
module_platform_driver() means one root command, "rmmod apple_pcie", is
enough to trigger it.

This series fixes the lifetime of cfg only.  It does not make these drivers
safe to unload: apple's IRQ handlers and microchip's PLDA IRQ domains are
still not released, both pre-existing and out of scope here.

The defect was found by code review; the trigger steps are in each patch,
but no oops or KASAN report is attached, as none was measured.

Patch 3/3 is one commit for the three remaining drivers and therefore
carries three Fixes: tags; it can be split apart if you prefer.

Hongyan Xu (3):
  PCI: apple: Fix ECAM config window use-after-free
  PCI: microchip: Fix ECAM config window use-after-free
  PCI: thunder-pem, hisi, thunder-ecam: Fix ECAM config window
    use-after-free

 drivers/pci/controller/dwc/pcie-hisi.c            | 1 +
 drivers/pci/controller/pci-thunder-ecam.c         | 1 +
 drivers/pci/controller/pci-thunder-pem.c          | 1 +
 drivers/pci/controller/pcie-apple.c               | 1 +
 drivers/pci/controller/plda/pcie-microchip-host.c | 1 +
 5 files changed, 5 insertions(+)

-- 
2.50.1.windows.1