1. Patchew
  2. linux
  3. View series

[PATCH v3] PCI: of_property: Omit bus properties without a subordinate bus

Bjorn Helgaas posted 1 patch 6 days, 2 hours ago
[PATCH v3] PCI: of_property: Omit bus properties without a subordinate bus
Posted by Bjorn Helgaas 6 days, 2 hours ago 
Author: Angel J <iamanaws@httpd.dev>

PCI: of_property: Omit bus properties without a subordinate bus

A bridge (a device with a Type 1 header) may not have a secondary bus
allocated (pdev->subordinate), e.g., if there are no available bus numbers
or the bridge secondary/subordinate bus numbers are not writable.

The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()
dereference pdev->subordinate without checking it.  When
CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer
dereference and early boot hang.

Generate 'bus-range' and 'interrupt-map' properties only when a subordinate
bus exists.  Keep the node and its remaining properties for bridges without
one.

The problem was latent since 407d1a51921e ("PCI: Create device tree node
for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create
device tree PCI host bridge node"), which appeared in v6.15.  Before
1f340724419e, of_pci_make_dev_node() returned early because the parent OF
node was missing.

Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
Signed-off-by: Angel J <iamanaws@httpd.dev>
[bhelgaas: move pdev->subordinate test to callees, commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org	# v6.6+
Link: https://patch.msgid.link/20260912043106.10715-1-iamanaws@httpd.dev
---
Changes in v3:
- Move pdev->subordinate tests to of_pci_prop_bus_range() and
  of_pci_prop_intr_map()

Changes in v2
(https://lore.kernel.org/all/20260912043106.10715-1-iamanaws@httpd.dev):
- Keep the dynamic OF node and skip only bus-range and interrupt-map
  when no subordinate bus exists, following review of v1.
- Tested on Linux 6.18.44 with the v1 guard removed.

v1
(https://lore.kernel.org/all/20260911230420.26244-1-iamanaws@httpd.dev)

diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
index 75a358f73e69..1500740cc55d 100644
--- a/drivers/pci/of_property.c
+++ b/drivers/pci/of_property.c
@@ -95,9 +95,13 @@ static int of_pci_prop_bus_range(struct pci_dev *pdev,
 				 struct of_changeset *ocs,
 				 struct device_node *np)
 {
-	u32 bus_range[] = { pdev->subordinate->busn_res.start,
-			    pdev->subordinate->busn_res.end };
+	u32 bus_range[2];
 
+	if (!pdev->subordinate)
+		return 0;
+
+	bus_range[0] = pdev->subordinate->busn_res.start;
+	bus_range[1] = pdev->subordinate->busn_res.end;
 	return of_changeset_add_prop_u32_array(ocs, np, "bus-range", bus_range,
 					       ARRAY_SIZE(bus_range));
 }
@@ -220,6 +224,9 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
 	int ret;
 	u8 pin;
 
+	if (!pdev->subordinate)
+		return 0;
+
 	pnode = pci_device_to_OF_node(pdev->bus->self);
 	if (!pnode)
 		pnode = pci_bus_to_OF_node(pdev->bus);
Re: [PATCH v3] PCI: of_property: Omit bus properties without a subordinate bus
Posted by Bjorn Helgaas 6 days, 2 hours ago 
On Fri, Sep 18, 2026 at 02:55:40PM -0500, Bjorn Helgaas wrote:
> Author: Angel J <iamanaws@httpd.dev>
> 
> PCI: of_property: Omit bus properties without a subordinate bus
> 
> A bridge (a device with a Type 1 header) may not have a secondary bus
> allocated (pdev->subordinate), e.g., if there are no available bus numbers
> or the bridge secondary/subordinate bus numbers are not writable.
> 
> The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()
> dereference pdev->subordinate without checking it.  When
> CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer
> dereference and early boot hang.
> 
> Generate 'bus-range' and 'interrupt-map' properties only when a subordinate
> bus exists.  Keep the node and its remaining properties for bridges without
> one.
> 
> The problem was latent since 407d1a51921e ("PCI: Create device tree node
> for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create
> device tree PCI host bridge node"), which appeared in v6.15.  Before
> 1f340724419e, of_pci_make_dev_node() returned early because the parent OF
> node was missing.
> 
> Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
> Signed-off-by: Angel J <iamanaws@httpd.dev>
> [bhelgaas: move pdev->subordinate test to callees, commit log]
> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> Cc: stable@vger.kernel.org	# v6.6+
> Link: https://patch.msgid.link/20260912043106.10715-1-iamanaws@httpd.dev

I put this on pci/for-linus, planning to be in v7.3, but I would love
to have testing reports to make sure it still works as the v2 does.

> ---
> Changes in v3:
> - Move pdev->subordinate tests to of_pci_prop_bus_range() and
>   of_pci_prop_intr_map()
> 
> Changes in v2
> (https://lore.kernel.org/all/20260912043106.10715-1-iamanaws@httpd.dev):
> - Keep the dynamic OF node and skip only bus-range and interrupt-map
>   when no subordinate bus exists, following review of v1.
> - Tested on Linux 6.18.44 with the v1 guard removed.
> 
> v1
> (https://lore.kernel.org/all/20260911230420.26244-1-iamanaws@httpd.dev)
> 
> diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
> index 75a358f73e69..1500740cc55d 100644
> --- a/drivers/pci/of_property.c
> +++ b/drivers/pci/of_property.c
> @@ -95,9 +95,13 @@ static int of_pci_prop_bus_range(struct pci_dev *pdev,
>  				 struct of_changeset *ocs,
>  				 struct device_node *np)
>  {
> -	u32 bus_range[] = { pdev->subordinate->busn_res.start,
> -			    pdev->subordinate->busn_res.end };
> +	u32 bus_range[2];
>  
> +	if (!pdev->subordinate)
> +		return 0;
> +
> +	bus_range[0] = pdev->subordinate->busn_res.start;
> +	bus_range[1] = pdev->subordinate->busn_res.end;
>  	return of_changeset_add_prop_u32_array(ocs, np, "bus-range", bus_range,
>  					       ARRAY_SIZE(bus_range));
>  }
> @@ -220,6 +224,9 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
>  	int ret;
>  	u8 pin;
>  
> +	if (!pdev->subordinate)
> +		return 0;
> +
>  	pnode = pci_device_to_OF_node(pdev->bus->self);
>  	if (!pnode)
>  		pnode = pci_bus_to_OF_node(pdev->bus);
Re: [PATCH v3] PCI: of_property: Omit bus properties without a subordinate bus
Posted by Angel J 6 days, 1 hour ago 
I didn't reply cuz I'm out for 3 weeks without access to that machine, so I can't test or confirm it works as expected (even though probably does)

Still, I will try to confirm as soon as I can.

Thanks

On Friday, September 18th, 2026 at 13:20, Bjorn Helgaas <helgaas@kernel.org> wrote:

> On Fri, Sep 18, 2026 at 02:55:40PM -0500, Bjorn Helgaas wrote:
> > Author: Angel J <iamanaws@httpd.dev>
> >
> > PCI: of_property: Omit bus properties without a subordinate bus
> >
> > A bridge (a device with a Type 1 header) may not have a secondary bus
> > allocated (pdev->subordinate), e.g., if there are no available bus numbers
> > or the bridge secondary/subordinate bus numbers are not writable.
> >
> > The dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map()
> > dereference pdev->subordinate without checking it.  When
> > CONFIG_PCI_DYNAMIC_OF_NODES is enabled, this can cause a NULL pointer
> > dereference and early boot hang.
> >
> > Generate 'bus-range' and 'interrupt-map' properties only when a subordinate
> > bus exists.  Keep the node and its remaining properties for bridges without
> > one.
> >
> > The problem was latent since 407d1a51921e ("PCI: Create device tree node
> > for bridge"), but wasn't reachable until 1f340724419e ("PCI: of: Create
> > device tree PCI host bridge node"), which appeared in v6.15.  Before
> > 1f340724419e, of_pci_make_dev_node() returned early because the parent OF
> > node was missing.
> >
> > Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
> > Signed-off-by: Angel J <iamanaws@httpd.dev>
> > [bhelgaas: move pdev->subordinate test to callees, commit log]
> > Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> > Cc: stable@vger.kernel.org	# v6.6+
> > Link: https://patch.msgid.link/20260912043106.10715-1-iamanaws@httpd.dev
> 

> I put this on pci/for-linus, planning to be in v7.3, but I would love
> to have testing reports to make sure it still works as the v2 does.
> 

> > ---
> > Changes in v3:
> > - Move pdev->subordinate tests to of_pci_prop_bus_range() and
> >   of_pci_prop_intr_map()
> >
> > Changes in v2
> > (https://lore.kernel.org/all/20260912043106.10715-1-iamanaws@httpd.dev):
> > - Keep the dynamic OF node and skip only bus-range and interrupt-map
> >   when no subordinate bus exists, following review of v1.
> > - Tested on Linux 6.18.44 with the v1 guard removed.
> >
> > v1
> > (https://lore.kernel.org/all/20260911230420.26244-1-iamanaws@httpd.dev)
> >
> > diff --git a/drivers/pci/of_property.c b/drivers/pci/of_property.c
> > index 75a358f73e69..1500740cc55d 100644
> > --- a/drivers/pci/of_property.c
> > +++ b/drivers/pci/of_property.c
> > @@ -95,9 +95,13 @@ static int of_pci_prop_bus_range(struct pci_dev *pdev,
> >  				 struct of_changeset *ocs,
> >  				 struct device_node *np)
> >  {
> > -	u32 bus_range[] = { pdev->subordinate->busn_res.start,
> > -			    pdev->subordinate->busn_res.end };
> > +	u32 bus_range[2];
> >
> > +	if (!pdev->subordinate)
> > +		return 0;
> > +
> > +	bus_range[0] = pdev->subordinate->busn_res.start;
> > +	bus_range[1] = pdev->subordinate->busn_res.end;
> >  	return of_changeset_add_prop_u32_array(ocs, np, "bus-range", bus_range,
> >  					       ARRAY_SIZE(bus_range));
> >  }
> > @@ -220,6 +224,9 @@ static int of_pci_prop_intr_map(struct pci_dev *pdev, struct of_changeset *ocs,
> >  	int ret;
> >  	u8 pin;
> >
> > +	if (!pdev->subordinate)
> > +		return 0;
> > +
> >  	pnode = pci_device_to_OF_node(pdev->bus->self);
> >  	if (!pnode)
> >  		pnode = pci_bus_to_OF_node(pdev->bus);
>

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.