mc_host_probe() calls pci_host_common_probe() but has no ->remove, so an unbind only runs devres_release_all(): gen_pci_unmap_cfg() -> pci_ecam_free() frees the ECAM config window while the bus tree stays registered - only pci_remove_bus() unlinks a bus, and only pci_host_common_remove() reaches it for a root bus. The next config access is a use-after-free in pci_ecam_map_bus(), which reads cfg->ops->bus_shift. Trigger: overlay rmdir in configfs, not rmmod (builtin_platform_driver()). Fix: add .remove = pci_host_common_remove, as pci-host-generic.c does since commit 01fcb7f777a9 ("PCI: Add support for unbinding the generic PCI host controller"), so pci_remove_root_bus() unlinks the bus before devres frees cfg. Scope: the PLDA IRQ domains it creates are not devres managed and stay unreleased - a separate, pre-existing issue. Fixes: 6f15a9c9f941 ("PCI: microchip: Add Microchip PolarFire PCIe controller driver") Cc: stable@vger.kernel.org Signed-off-by: Hongyan Xu --- drivers/pci/controller/plda/pcie-microchip-host.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/pci/controller/plda/pcie-microchip-host.c b/drivers/pci/controller/plda/pcie-microchip-host.c index 24bbf93b8051..f7b75013d9fc 100644 --- a/drivers/pci/controller/plda/pcie-microchip-host.c +++ b/drivers/pci/controller/plda/pcie-microchip-host.c @@ -821,6 +821,7 @@ MODULE_DEVICE_TABLE(of, mc_pcie_of_match); static struct platform_driver mc_pcie_driver = { .probe = mc_host_probe, + .remove = pci_host_common_remove, .driver = { .name = "microchip-pcie", .of_match_table = mc_pcie_of_match, -- 2.50.1.windows.1