Linux kernel (drivers/pci): A pci_slot holds an uncounted pointer to the pci_bus below it, and on hot removal the bus

Impact

A pci_slot holds an uncounted pointer to the pci_bus below it, and on hot removal the bus can be destroyed before the slot is. The slot release path then dereferences freed memory, crashing the host. The window exists because nothing prevents a driver binding between the stop and remove halves of PCI teardown, so a device that drops its link at the wrong moment gets a use-after-free rather than a clean removal.

Who can reach it

Driven by the device, not by tenant software: any event that clears Presence Detect / Data Link Layer Link Active on a hotplug-capable downstream port starts the removal - a link drop, a card reset, a sled being pulled, or in the reported case a host-router reset during driver probe. Needs pciehp managing the slot and a hotplug hierarchy below it, which is the normal shape for NVMe bays, PCIe switch fabrics and any externally cabled expansion. A tenant that can wedge or reset its assigned card hard enough to bounce the link influences when it fires; it cannot reach the code directly.

What to do

Boot a kernel where pci_slot takes a counted reference on its pci_bus. Interim: avoid driver bind/unbind churn on hotplug hierarchies while removals are in flight, and treat repeated link-down events on a node as a drain signal rather than something to let retry in place.

References