PCI: brcmstb: Protect root bus removal with rescan lock

Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-5-18255117159@163.com

diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
index 714bcab97b603f8065f7c765f3e37fbdc0404f03..7ca27f0756c9bac2a33535fbed65e4804243bdfc 100644 (file)
--- a/drivers/pci/controller/pcie-brcmstb.c
+++ b/drivers/pci/controller/pcie-brcmstb.c
@@ -1894,8 +1894,10 @@ static void brcm_pcie_remove(struct platform_device *pdev)
        struct brcm_pcie *pcie = platform_get_drvdata(pdev);
        struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
 
+       pci_lock_rescan_remove();
        pci_stop_root_bus(bridge->bus);
        pci_remove_root_bus(bridge->bus);
+       pci_unlock_rescan_remove();
        if (pcie->cfg->has_err_report)
                brcm_unregister_die_notifiers(pcie);