From nobody Sun Jun 14 17:36:47 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 31506334C27 for ; Sat, 4 Apr 2026 08:53:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775292795; cv=none; b=J3kjW7jkLs5vQvcMMcPvI/vCFdmdCGsSHmtFXa6zNXFK8U7kXFdJNTBVZzqfXaFlo/hJH8ON1Lyfa3F+uQXIlzLKKX7smqt6cQuce+TOXODd4UTe50Hjzx/bA0gmAwrudGtTZcQEhR9Lm0L3i94nW//uXKZFMioSZP4Zi+ullB4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775292795; c=relaxed/simple; bh=cLSMdyjO0adghxbWrzhTn9AZjVp8pKccOC2A/dtndtU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ddZDQmRxTlTppzN0xSuACdo7vFUkGEzl/dp84UMtLyRBBpvaGNxh/SWminUujoJeLVEVH9Rk0f4T7O5ohMydgRVi7cTauZgHdNfooejSpA2k0pM/w8BCu5IOQLaQOi5IfGnlQECCl97aLS7zmhUsGd81froCz6cKn9nu9knm2aM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=WvkKoBXT; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=EuiXWe18; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="WvkKoBXT"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="EuiXWe18" Received: from pps.filterd (m0279864.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6344e9Tg2973517 for ; Sat, 4 Apr 2026 08:53:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= iUX5v+rwAN0X+mqB/JXSwM4VegcAMMvX06bkHKATt7E=; b=WvkKoBXTi3gfi1Kg JwHAIAhOEizVXJWWPd/YVufSzV2+W4pgr/iV8OTQCK0SHrPl7mPbmW+9Ru52x62Y Azng5k3bPhR3ICidSyZwTUWDpU1N0c92ozdnKSuAPe8O7QYtwEhhthiNYvNbxGZV 4GW6Itnxy8L+DEJxAABrYA7uVX2kt5g2UDK27Syrvr5K7urRyST4zz5aq+KjS0b2 Ziyl4qQDdtJe3HDqIID3lMsJguvhUe7VV4BzYAejYJC1lGf98sUtnpTnujUGT5En d2RpfCc7Jsa0wy3V7GURDakUkRZ6WksHAFmJy3BKxt+xjFZ4vCAFb9Daoap5UkY2 PGz+lg== Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4dauth8dt0-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 04 Apr 2026 08:53:12 +0000 (GMT) Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2a90510a6d1so18297775ad.0 for ; Sat, 04 Apr 2026 01:53:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1775292792; x=1775897592; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=iUX5v+rwAN0X+mqB/JXSwM4VegcAMMvX06bkHKATt7E=; b=EuiXWe18lwtRqkA+GawkNgsCPVvBpBf2uBKoF0+XFjXYS+GMlIO/n+yvnyEWfaKsgR omUyM4hS6YzOGlltHD27+RvCrtiCUobFCTuHmuWLZNHo/XcMKcInwoJOigmhCjvtuXR4 fjyxfBdiqDtoqF/K0B1n77o/V26jnj29BrSPSm1QvrTNGQ7uzJU3tN9vGNtW3YFxSLVQ Us9XfkyhXDkzKjTtH1JFsl8yDNIrVP2ERDP/v3U5f9HhtvQdHgfNRJhZHWsEgvkBWc9C wm40hBfKI5coYMaXjydi5R5zHUYUCVw2jn6XogC3ktGPAiOy7Lpj4A2sZ+5PaZpe3WKf hJKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775292792; x=1775897592; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=iUX5v+rwAN0X+mqB/JXSwM4VegcAMMvX06bkHKATt7E=; b=rRZMWBHeI8dgWLGZ+pmnMkN7Nmu3jgc8weDvR960UB8MueI1vGKocWbX4RcSo4SP/O tRfRXmnCWjt7YI5SFnyQ5eObQJ9TliNVEkcTTnKV1l3o04FfbyzznKSvohAS+rMaP14m gAigbtENRDa/OraKnN5q6U/+VSP/8ize5KwmomeOa8nXb9si+mIIfGBDz//6uDjCrIL2 Fkyk7jmgIRrdlI7yss7Ias/ey/7zQgyRAQSPn+//V/PiWSiowHLHD5eWk9WC4m8T/El+ xeIJ88I4Pt33XOuPGHNgvelNaqxpE+nFisMidDz8ExEoHoQobR2fiBRXJ55oyaZMGaMF yegg== X-Forwarded-Encrypted: i=1; AJvYcCVj2YrM5d/hHzjzOUFG7pBmVmUdcmEH/1nchgYbfxqiqf11aLB0IVTHk5FfptMVXMtwyaPjcPcitaYPgbo=@vger.kernel.org X-Gm-Message-State: AOJu0YxPcPGTccfQ1akRt2FMywLzyrFQzOJD0l4eTakGvkvd3KqON7rD TfrgnyG+q3S8RIgj3vhqg88yUIuLvgcBVF6U+ywd9GBmcPHaXD/odT+Rz45ZnZSzyBUXLHrelPp APi0Xbg3iSSBU+VGtg3rA+V2ExMCfvoy3+vks5vt7x5UdBmbfINySkK+GFnkx6xapoFQ= X-Gm-Gg: AeBDievZcwWaVxauIHXwgy4QNAjydfIyOmkOamnqMGBzUTJFyu8Uyi95EQHQm4AnQ2J kEClD+5me2OEMHvsL6oU28OISgUHbVohE340CrdQrO51dmb34ikCWJowPU3RRZFIOseDVWQGl+I s3cvzrG9ltIui02U1ve1K4QwxYssZTk3jk0kUzyJu8/bGgm/vnsmpXwjPDjGwic5CEGZCH4pbNE mnYfs769ssGrfZIMgOxRxJI9IL+7iqBmGoUIYXWdrsOfQH80B+o9ei2wOOOyNwL8Mt/vUzar2an G6AVPt9k6uSEGGtiKE5lqB8/tjU765XV/yQ/AebGF9rVa4+KdYSrO5eOEXM7bY1ps1ZHNjPpiai 26J/4MfhdEApXm4xqpfBXSZ6Nhc+OP+91bZ8TkAzkrnj72dfay+0S+D4p X-Received: by 2002:a17:903:b8e:b0:2b0:5450:a910 with SMTP id d9443c01a7336-2b28219df6emr58865615ad.17.1775292791595; Sat, 04 Apr 2026 01:53:11 -0700 (PDT) X-Received: by 2002:a17:903:b8e:b0:2b0:5450:a910 with SMTP id d9443c01a7336-2b28219df6emr58865375ad.17.1775292791080; Sat, 04 Apr 2026 01:53:11 -0700 (PDT) Received: from hu-krichai-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2749e2e97sm106883085ad.82.2026.04.04.01.53.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Apr 2026 01:53:10 -0700 (PDT) From: Krishna Chaitanya Chundru Date: Sat, 04 Apr 2026 14:22:59 +0530 Subject: [PATCH 1/2] PCI: Add pcie_link_is_active() to determine if the link is active Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260404-fix_pci_access-v1-1-416f32c6f7ec@oss.qualcomm.com> References: <20260404-fix_pci_access-v1-0-416f32c6f7ec@oss.qualcomm.com> In-Reply-To: <20260404-fix_pci_access-v1-0-416f32c6f7ec@oss.qualcomm.com> To: Bjorn Helgaas , manivannan.sadhasivam@oss.qualcomm.com Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Krishna Chaitanya Chundru , Shawn Anastasio , Timothy Pearson , Lukas Wunner X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1775292784; l=7261; i=krishna.chundru@oss.qualcomm.com; s=20230907; h=from:subject:message-id; bh=cLSMdyjO0adghxbWrzhTn9AZjVp8pKccOC2A/dtndtU=; b=mufd4JHPj+WA+ZXoNU0SlTovD+ERWWnIHb7zVuhEAoqrB4oi43o+/Md4HTDwTkHPwqaD1GnkB pkcAP1w+3olBkxJOpu1LLLpL3QLPldKoa8BoUxzqLgK2hnvaA7kZb9i X-Developer-Key: i=krishna.chundru@oss.qualcomm.com; a=ed25519; pk=10CL2pdAKFyzyOHbfSWHCD0X0my7CXxj8gJScmn1FAg= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDA0MDA3OCBTYWx0ZWRfXyFedemawLf4O N08MzPmChQEoAs0v9aoBIpjAGEGbRX7HMo/B8mZ+kg+jCof7JQ2zlPxISpwSobiwhMEngXJNkju TcztVmBfZbaTl8BjpaTYDzdahxymyu0ftdxGtocXDCccN5VKl/bfmDVU6ja3LmXlh+zKtDxRoXK DQbfziVoHQZ22jfZ0+o0kjWQuJd8MWIwvMsORh6O9VMtbrB3Vof/ppAgIGjiSKOOegRVnngEVPA ZHVRFhj17ln/gdzImdj5ccuusdnDUy0g1plvLlC9bpOrXh7fPqEj1PxKZgh8eE5RBjMSyoR+pwe o+ePwYqm7izpcJP2cflPNSd9CeBNZUd2Aenh7pZAKrJ8CY5PnhE/s2IQ6kgVbub4qgSjnjnJNA7 D1Z5eVY4Jr5DlR1u7R5SUSGtNCPRPmIwII3OKBrDhFkDP2+ofXjpxSuOoHGCLfQUUP7wkO1uAed r5qamLEElxFJAp93h5Q== X-Proofpoint-GUID: _oDaxTDsLHPiDvJEFMfdxnrNwDXTjbrg X-Authority-Analysis: v=2.4 cv=MIptWcZl c=1 sm=1 tr=0 ts=69d0d178 cx=c_pps a=IZJwPbhc+fLeJZngyXXI0A==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=DLE-xEQoUa54y48t:21 a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=DJpcGTmdVt4CTyJn9g5Z:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=_AprYWD3AAAA:8 a=sQS_rdureY0rGLqyAPEA:9 a=QEXdDO2ut3YA:10 a=uG9DUKGECoFWVXl0Dc02:22 a=fKH2wJO7VO9AkD4yHysb:22 X-Proofpoint-ORIG-GUID: _oDaxTDsLHPiDvJEFMfdxnrNwDXTjbrg X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-03_07,2026-04-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 malwarescore=0 suspectscore=0 lowpriorityscore=0 priorityscore=1501 adultscore=0 impostorscore=0 phishscore=0 bulkscore=0 spamscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2604040078 Add pcie_link_is_active() a common API to check if the PCIe link is active, replacing duplicate code in multiple locations. Signed-off-by: Shawn Anastasio Signed-off-by: Timothy Pearson Signed-off-by: Krishna Chaitanya Chundru Reviewed-by: Lukas Wunner --- This patch is already submitted as part of different series, but this is dropped from the series. we want to bring this now, to check null point access issue at pci_store_saved_state() due to linkdown. Link to previous patch: https://lore.kernel.org/all/20250828-qps615_v4_1-v6= -7-985f90a7dd03@oss.qualcomm.com/ --- drivers/pci/hotplug/pciehp.h | 1 - drivers/pci/hotplug/pciehp_ctrl.c | 2 +- drivers/pci/hotplug/pciehp_hpc.c | 35 ++++------------------------------- drivers/pci/pci.c | 28 +++++++++++++++++++++++++--- drivers/pci/pci.h | 1 + 5 files changed, 31 insertions(+), 36 deletions(-) diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h index debc79b0adfb2c8e06aabb765e1741572685100b..79df49cc99463829f563db1dc80= 14a51ccfac0af 100644 --- a/drivers/pci/hotplug/pciehp.h +++ b/drivers/pci/hotplug/pciehp.h @@ -186,7 +186,6 @@ int pciehp_query_power_fault(struct controller *ctrl); int pciehp_card_present(struct controller *ctrl); int pciehp_card_present_or_link_active(struct controller *ctrl); int pciehp_check_link_status(struct controller *ctrl); -int pciehp_check_link_active(struct controller *ctrl); bool pciehp_device_replaced(struct controller *ctrl); void pciehp_release_ctrl(struct controller *ctrl); =20 diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp= _ctrl.c index 7805f697a02ceab33cc962587e0ad85c16c0d962..e165e6d810214f26451920976b1= f11d32dd162aa 100644 --- a/drivers/pci/hotplug/pciehp_ctrl.c +++ b/drivers/pci/hotplug/pciehp_ctrl.c @@ -269,7 +269,7 @@ void pciehp_handle_presence_or_link_change(struct contr= oller *ctrl, u32 events) /* Turn the slot on if it's occupied or link is up */ mutex_lock(&ctrl->state_lock); present =3D pciehp_card_present(ctrl); - link_active =3D pciehp_check_link_active(ctrl); + link_active =3D pcie_link_is_active(ctrl->pcie->port); if (present <=3D 0 && link_active <=3D 0) { if (ctrl->state =3D=3D BLINKINGON_STATE) { ctrl->state =3D OFF_STATE; diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_= hpc.c index 4c62140a3cb444b1d29a378099d4c3d377b93d15..abfae48470ce44329d2bf84469e= 826ab4dea99af 100644 --- a/drivers/pci/hotplug/pciehp_hpc.c +++ b/drivers/pci/hotplug/pciehp_hpc.c @@ -221,33 +221,6 @@ static void pcie_write_cmd_nowait(struct controller *c= trl, u16 cmd, u16 mask) pcie_do_write_cmd(ctrl, cmd, mask, false); } =20 -/** - * pciehp_check_link_active() - Is the link active - * @ctrl: PCIe hotplug controller - * - * Check whether the downstream link is currently active. Note it is - * possible that the card is removed immediately after this so the - * caller may need to take it into account. - * - * If the hotplug controller itself is not available anymore returns - * %-ENODEV. - */ -int pciehp_check_link_active(struct controller *ctrl) -{ - struct pci_dev *pdev =3D ctrl_dev(ctrl); - u16 lnk_status; - int ret; - - ret =3D pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnk_status); - if (ret =3D=3D PCIBIOS_DEVICE_NOT_FOUND || PCI_POSSIBLE_ERROR(lnk_status)) - return -ENODEV; - - ret =3D !!(lnk_status & PCI_EXP_LNKSTA_DLLLA); - ctrl_dbg(ctrl, "%s: lnk_status =3D %x\n", __func__, lnk_status); - - return ret; -} - static bool pci_bus_check_dev(struct pci_bus *bus, int devfn) { u32 l; @@ -468,7 +441,7 @@ int pciehp_card_present_or_link_active(struct controlle= r *ctrl) if (ret) return ret; =20 - return pciehp_check_link_active(ctrl); + return pcie_link_is_active(ctrl_dev(ctrl)); } =20 int pciehp_query_power_fault(struct controller *ctrl) @@ -615,8 +588,8 @@ static void pciehp_ignore_link_change(struct controller= *ctrl, * Synthesize it to ensure that it is acted on. */ down_read_nested(&ctrl->reset_lock, ctrl->depth); - if (!pciehp_check_link_active(ctrl) || pciehp_device_replaced(ctrl)) - pciehp_request(ctrl, ignored_events); + if (!pcie_link_is_active(pdev) || pciehp_device_replaced(ctrl)) + pciehp_request(ctrl, PCI_EXP_SLTSTA_DLLSC); up_read(&ctrl->reset_lock); } =20 @@ -922,7 +895,7 @@ int pciehp_slot_reset(struct pcie_device *dev) pcie_capability_write_word(dev->port, PCI_EXP_SLTSTA, PCI_EXP_SLTSTA_DLLSC); =20 - if (!pciehp_check_link_active(ctrl)) + if (!pcie_link_is_active(ctrl_dev(ctrl))) pciehp_request(ctrl, PCI_EXP_SLTSTA_DLLSC); =20 return 0; diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 8479c2e1f74f1044416281aba11bf071ea89488a..1488c93d4e22371480165cb55af= c7a0c3cae238e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -4756,7 +4756,6 @@ int pci_bridge_wait_for_secondary_bus(struct pci_dev = *dev, char *reset_type) return 0; =20 if (pcie_get_speed_cap(dev) <=3D PCIE_SPEED_5_0GT) { - u16 status; =20 pci_dbg(dev, "waiting %d ms for downstream link\n", delay); msleep(delay); @@ -4772,8 +4771,7 @@ int pci_bridge_wait_for_secondary_bus(struct pci_dev = *dev, char *reset_type) if (!dev->link_active_reporting) return -ENOTTY; =20 - pcie_capability_read_word(dev, PCI_EXP_LNKSTA, &status); - if (!(status & PCI_EXP_LNKSTA_DLLLA)) + if (pcie_link_is_active(dev) <=3D 0) return -ENOTTY; =20 return pci_dev_wait(child, reset_type, @@ -6116,6 +6114,30 @@ void pcie_print_link_status(struct pci_dev *dev) } EXPORT_SYMBOL(pcie_print_link_status); =20 +/** + * pcie_link_is_active() - Checks if the link is active or not + * @pdev: PCI device to query + * + * Check whether the downstream link is currently active. Note it is + * possible that the card is removed immediately after this so the + * caller may need to take it into account. + * + * Return: true if link is active, or -ENODEV if the config read fails. + */ +int pcie_link_is_active(struct pci_dev *pdev) +{ + u16 lnk_status; + int ret; + + ret =3D pcie_capability_read_word(pdev, PCI_EXP_LNKSTA, &lnk_status); + if (ret =3D=3D PCIBIOS_DEVICE_NOT_FOUND || PCI_POSSIBLE_ERROR(lnk_status)) + return -ENODEV; + + pci_dbg(pdev, "lnk_status =3D %#06x\n", lnk_status); + return !!(lnk_status & PCI_EXP_LNKSTA_DLLLA); +} +EXPORT_SYMBOL(pcie_link_is_active); + /** * pci_select_bars - Make BAR mask from the type of resource * @dev: the PCI device for which BAR mask is made diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h index 13d998fbacce6698514d92500dfea03cc562cdc2..c9a6e5d3de3aeab125d2e456456= 359aa857e7a19 100644 --- a/drivers/pci/pci.h +++ b/drivers/pci/pci.h @@ -355,6 +355,7 @@ static inline int pci_proc_detach_bus(struct pci_bus *b= us) { return 0; } /* Functions for PCI Hotplug drivers to use */ int pci_hp_add_bridge(struct pci_dev *dev); bool pci_hp_spurious_link_change(struct pci_dev *pdev); +int pcie_link_is_active(struct pci_dev *dev); =20 #if defined(CONFIG_SYSFS) && defined(HAVE_PCI_LEGACY) void pci_create_legacy_files(struct pci_bus *bus); --=20 2.34.1 From nobody Sun Jun 14 17:36:47 2026 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78BC931A7EA for ; Sat, 4 Apr 2026 08:53:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775292796; cv=none; b=hIZuID3SS6NnoYNUiB9tfGRx0uehr3s+2qGmiotScv79VrrxhOZ66qWwwZ8X1yY9zRNUy6q51kZNfOYYsjZkb3bp7v54XNTzlMbaWol6lDtMaxItgEN4phoKw1WwqbVCseis1m5GIhuegKXh0pgmk0x7rXelvWWqCIPc3BKKRgQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775292796; c=relaxed/simple; bh=9OJ4UNKQcRb8Ws8QLo61/dvK/QzgaBZThrXn5UYtEf8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=EFN4DAHEslUTwNg/oGmAJW5BG9RAYzbd1Ll9TF8tlYdmhDdQWO4mMLtF5JFwxcu4takwGlVUiwS3nckEg908tiEnqF1PMdrSOKDag9zkGnkViwYdgBCv5OW/1PxlehsiwPW9w44Kblr4cpVmxWGeDr4juU7V/J1d27NoiToXPvQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=m70sZ2tN; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=iJfLKY3w; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="m70sZ2tN"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="iJfLKY3w" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6343Zfrs1873008 for ; Sat, 4 Apr 2026 08:53:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= euurnDdp2gg95lsunKzyUav3a4dM9U326nl7pdJ2T68=; b=m70sZ2tN0SNU37Zx LwlhVXTw8AEzLK6eDxWuy8FKGfignt3zfYfb8EgicZDPXmVGi43xJUfnRGfap0iK oAgPobK6Ix8Igb0LfcjBRcG4GG5X94cr91Q7YOGn1ncnZ1nSY8X1ak6nMvqKe/XP IeDPnLZQ6OwUZ16ODSSE7F2x3EpY/gbIMy8xAqvISQ/qr4eYfS+zUrrVbDCIosPt 64TyLsVl3o4vSGzya/x46Gvr75pGvrVOwB2lAq9SuRGbMaeAP7DPYDW/UkHP512R TxM6L/Y/OPtP+UiREgRHvrq+ZK07SCgd2NX32Xc0zQyJ+Prdh1+XWOyuYxZLRJ3I 75hxsQ== Received: from mail-pl1-f197.google.com (mail-pl1-f197.google.com [209.85.214.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4datv18gxk-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 04 Apr 2026 08:53:14 +0000 (GMT) Received: by mail-pl1-f197.google.com with SMTP id d9443c01a7336-2b23c909256so36936735ad.0 for ; Sat, 04 Apr 2026 01:53:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1775292794; x=1775897594; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=euurnDdp2gg95lsunKzyUav3a4dM9U326nl7pdJ2T68=; b=iJfLKY3waIjvvJgHDFHO2itJp7X/Pk28sMAyjE0Qf7pPVI9mlqggLdgTPkod3gNVZl YZaQFzuo0hcP0ZFCQNiyQCiyIBtcDBgCSKeqHjvP0u+kRLUIS95o6lDNhoHgn0scWQSu EZ9oxPgfLOoco6bVv7/EkM8sCI6sPd+7K1ZuMlqGUsncp5vEs4OtH9A3WYyhrTqjFjLE lUqAfUi4Nx3kxORgKJ9LeQg3bb0SCaAiORz5zOPnwmXbGANs054xCK+dgZnPGoF3mZaR PWE/WT9OQkhxh7maa+m3bf+aGNBJFdQjk/8BKwClB49g9PIEFZlALYuPWJpq/tg7Rp13 R3PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775292794; x=1775897594; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=euurnDdp2gg95lsunKzyUav3a4dM9U326nl7pdJ2T68=; b=Dmb2eg4uZcVfERhTorSaoKYd7T1sQ+CbuQeAaY7S7/HMUD8Hh1RnGjThU6/baTYbN4 jYEx5t7+gdhmL/sHVRMzi8on2rPrbUqX5rxJcY46UYoSKDhxV9SE3Cxl6bSIM8ABeDHE F5Mov0DocGf1MUXqQXY2Sp+7JK1in1F5eFwYrw9mIuI+T/ik6h0u4zz92mjcbkIfj7P9 ukPPVG0wYIcHpuE6Txqu6ka89N0dkEEMLY4Egr1ZPScIoNrEr/n65YlZAy3GDT4om1Go D7FoziLJKCQkZGQ8uncRQb79d3rNqEqPRG840SLFLFBhyqe4wvY96oc/s18SvbgmBGiY 51vw== X-Forwarded-Encrypted: i=1; AJvYcCVg/YPfqNyV8DYUgobPLZL2bsd1OouX7ZlNbriGc1xKGzFB64PPXUttv7NahvIUlydqD7GmHKWuVC7gjDE=@vger.kernel.org X-Gm-Message-State: AOJu0YyHdWao3SyO0wHpGaCKo6o1bRkvbH19ixHExqsCJ6d69f9Qolbs nMAGH9aBy0e/PhKnnSMHMgDMvUcmoEcZb3EepgyyuS3CoLzcomWai1dAP2lsGiUFB3R6CxMCxiU nHiUUio29z825T5J4glbnoCnxd7wU7PbwBjQJSsE1S1aHWYr35o4n9qnl407+rBd4234= X-Gm-Gg: AeBDiesEGjlKRu7pIhe1oGjg1Q3EVGwz3KkVzVY4VM++ObetFAbPz1c/aZBYRCV4E48 iCYENVzRHnQjwIPMvrKYmXyoa+KKNmDtGG6nJAtJ00GNFcCopvsWT3vjIJnNUwf14Ax4fIPCLv9 ho07qjrMygG05rVezt/16o+ofkTar44Ap1/QQdY2xjOShIgbN8jijEjflA8X9GbJ7uLresATnUi /uBl1oTGxf7ryj3kVevFLSSyhpo1ZaG/3uIZKL8ToMDfHavfD3uAQ55850ESVB/UoKp6ht5l/BN O9uT7TqmXx6WeuBfXrVwduEEGGPaRVEktchsPioSNbK4WwiH81xBOJMk0K2fe9bGJrj0n9lfjDX jAfyOr7Vae/1fE259dU+HoT75XLhShkluZGGx3qdNVaX7rFX0/wTTCzi+ X-Received: by 2002:a17:903:18a:b0:2b0:9c2b:641d with SMTP id d9443c01a7336-2b28164c170mr64609725ad.2.1775292794144; Sat, 04 Apr 2026 01:53:14 -0700 (PDT) X-Received: by 2002:a17:903:18a:b0:2b0:9c2b:641d with SMTP id d9443c01a7336-2b28164c170mr64609525ad.2.1775292793610; Sat, 04 Apr 2026 01:53:13 -0700 (PDT) Received: from hu-krichai-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2749e2e97sm106883085ad.82.2026.04.04.01.53.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Apr 2026 01:53:13 -0700 (PDT) From: Krishna Chaitanya Chundru Date: Sat, 04 Apr 2026 14:23:00 +0530 Subject: [PATCH 2/2] PCI: Fix NULL pointer access in pci_store_saved_state() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260404-fix_pci_access-v1-2-416f32c6f7ec@oss.qualcomm.com> References: <20260404-fix_pci_access-v1-0-416f32c6f7ec@oss.qualcomm.com> In-Reply-To: <20260404-fix_pci_access-v1-0-416f32c6f7ec@oss.qualcomm.com> To: Bjorn Helgaas , manivannan.sadhasivam@oss.qualcomm.com Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Krishna Chaitanya Chundru X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1775292785; l=2834; i=krishna.chundru@oss.qualcomm.com; s=20230907; h=from:subject:message-id; bh=9OJ4UNKQcRb8Ws8QLo61/dvK/QzgaBZThrXn5UYtEf8=; b=YtTtpgacAWIa6+gDdtLCAfY+uvhDy3uUYQ8KKTtVJGF3HsC2IxyafsNdiEwAqgCcH7zPAiSfy YWoi4GOcxT2C8FXP8HmGN2DjGb8ZVujMMY3bMfMJJ1gASRpVQR/yfdW X-Developer-Key: i=krishna.chundru@oss.qualcomm.com; a=ed25519; pk=10CL2pdAKFyzyOHbfSWHCD0X0my7CXxj8gJScmn1FAg= X-Proofpoint-GUID: hbqs7Jf9RLe9hMtW2VLCTGhUKEJifSQc X-Authority-Analysis: v=2.4 cv=GLEF0+NK c=1 sm=1 tr=0 ts=69d0d17a cx=c_pps a=cmESyDAEBpBGqyK7t0alAg==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=EUspDBNiAAAA:8 a=SbfQo5s_ALff5BtGSsgA:9 a=QEXdDO2ut3YA:10 a=1OuFwYUASf3TG4hYMiVC:22 X-Proofpoint-ORIG-GUID: hbqs7Jf9RLe9hMtW2VLCTGhUKEJifSQc X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNDA0MDA3OCBTYWx0ZWRfXye0RCrvnNbgw JJOAiN31Npask9mpjrva6lqO6aM9OEiBLKngMdTBEHa/NHvDMLlQfMcGWLvuoUXGZuDub7+QZ2l QqJtjxdz83sFgTtRbEdP25fgkkTCam/Njft24y+V/8XVzaeLRcGtwoW65CdZsHpGvavac+Xh0Ij zuXJMITozEND+wVJFx5gBa76CSFz2khwTuSMWoHqiwGt1LcurhEsd5XCA1ZGj/rUui3ZY3Dy7vB J2+rJJ8TpEXNnVpFKWmDquofdcHlqQRayFmDy1J99j+g3bjkfFYo+3vfL1skoEG2AejDnZH1rGd uTo/qKrhri6NWKIFUkCIEWkZQUglkf4SYKKWvGRqg+IDxcuCA3hNkhtJylW9Yxyzwfd7jhAuiax lUI8181UU79i+Y7+W/lpuYnVSynL84UnLnhMnxAnHnh6trMgvtfW8sSUj8vErp/fPGgpZ3dfOOk uMArUvirdw9AKSsI0Ew== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-04-03_07,2026-04-03_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 phishscore=0 spamscore=0 suspectscore=0 adultscore=0 priorityscore=1501 clxscore=1015 lowpriorityscore=0 impostorscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603050001 definitions=main-2604040078 If the PCIe link goes down while pci_save_state() is in progress, reads from the device configuration space may return invalid values(all 0xF's). This can lead to saving corrupted or inconsistent capability state and subsequent memory corruption. The issue is not limited to a specific capability type and may occur at any point during the save process. One example is, while saving VC extended capability save path (pci_save_vc_state() / pci_vc_do_save_buffer()) then interprets all-1s capability fields as valid and ends up writing far beyond the allocated pci_cap_saved_state buffer, corrupting the pci_dev->saved_cap_space list. The call stack of the issue as follows. [ T1634] Unable to handle kernel NULL pointer dereference at virtual addres= s 0000000000000013 [ T1634] Mem abort info: [ T1634] ESR =3D 0x96000005 [ T1634] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [ T1634] SET =3D 0, FnV =3D 0 [ T1634] EA =3D 0, S1PTW =3D 0 [ T1634] FSC =3D 0x05: level 1 translation fault [ T1634] Data abort info: [ T1634] ISV =3D 0, ISS =3D 0x00000005 [ T1634] CM =3D 0, WnR =3D 0 [ T1634] user pgtable: 4k pages, 39-bit VAs, pgdp=3D00000000ac2ed000 [ T1634] [0000000000000013] pgd=3D0000000000000000, p4d=3D0000000000000000,= pud=3D0000000000000000 [ T1634] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ T1634] Dumping ftrace buffer: [ T1634] (ftrace buffer empty) [ T1634] pc : pci_store_saved_state+0x40/0xd8 [ T1634] lr : cnss_set_pci_config_space+0x54/0x100 [cnss2] [ T1634] Call trace: [ T1634] pci_store_saved_state+0x40/0xd8 [ T1634] cnss_set_pci_config_space+0x54/0x100 [cnss2] Fix this issue by bailing out early from pci_store_saved_state() if link is not active and also make saved_state =3D false. The link state check here is racy since the link may transition at any time. This is a best-effort attempt to avoid saving PCI state when the link is already down. Signed-off-by: Krishna Chaitanya Chundru --- drivers/pci/pci.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 1488c93d4e22371480165cb55afc7a0c3cae238e..06bd6b7d62ec1a41bd12af2ab47= ecd2b77665c7e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -1875,6 +1875,16 @@ struct pci_saved_state *pci_store_saved_state(struct= pci_dev *dev) if (!dev->state_saved) return NULL; =20 + /* + * The link state check here is racy since the link may transition at + * any time. This is a best-effort attempt to avoid saving PCI state + * when the link is already down. + */ + if (!pcie_link_is_active(dev)) { + dev->state_saved =3D false; + return NULL; + } + size =3D sizeof(*state) + sizeof(struct pci_cap_saved_data); =20 hlist_for_each_entry(tmp, &dev->saved_cap_space, next) --=20 2.34.1