Re: [PATCH] ata: pata_sl82c105: fix bridge revision use-after-free

On Thu, Aug 06, 2026 at 02:06:28PM +0800, Hongyan Xu wrote:
> pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b
> ("PCI: Change all drivers to use pci_device->revision") replaced a
> configuration-space read with direct access to the cached revision field,
> but left that access after pci_dev_put(). The bridge may therefore be freed
> before its revision is read.
> 
> Read the revision before dropping the reference.
> 
> Fixes: 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision")
> Signed-off-by: Hongyan Xu <[email protected]>
> ---
>  drivers/ata/pata_sl82c105.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c
> index 2d24c6b3e9d9..25bce3fe2a10 100644
> --- a/drivers/ata/pata_sl82c105.c
> +++ b/drivers/ata/pata_sl82c105.c
> @@ -264,6 +264,7 @@ static struct ata_port_operations sl82c105_port_ops = {
>  static int sl82c105_bridge_revision(struct pci_dev *pdev)
>  {
>  	struct pci_dev *bridge;
> +	u8 revision;
>  
>  	/*
>  	 * The bridge should be part of the same device, but function 0.
> @@ -285,8 +286,9 @@ static int sl82c105_bridge_revision(struct pci_dev *pdev)
>  	/*
>  	 * We need to find function 0's revision, not function 1
>  	 */
> +	revision = bridge->revision;
>  	pci_dev_put(bridge);
> -	return bridge->revision;
> +	return revision;
>  }
>  
>  static void sl82c105_fixup(struct pci_dev *pdev)
> -- 
> 2.50.1.windows.1
> 

Makes sense to me:
Reviewed-by: Niklas Cassel <[email protected]>