PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()

JIRA: https://issues.redhat.com/browse/RHEL-67693
Upstream Status: 4acc902

commit 4acc902
Author: Zijun Hu <[email protected]>
Date:   Thu Nov 7 08:53:08 2024 +0800

    PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()

    pci_epc_destroy() invokes pci_bus_release_domain_nr() to release the PCI
    domain ID, but there are two issues:

      - 'epc->dev' is passed to pci_bus_release_domain_nr() which was already
        freed by device_unregister(), leading to a use-after-free issue.

      - Domain ID corresponds to the EPC device parent, so passing 'epc->dev'
        is also wrong.

    Fix these issues by passing 'epc->dev.parent' to
    pci_bus_release_domain_nr() and also do it before device_unregister().

    Fixes: 0328947 ("PCI: endpoint: Assign PCI domain number for endpoint controllers")
    Signed-off-by: Zijun Hu <[email protected]>
    Reviewed-by: Manivannan Sadhasivam <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    [mani: reworded subject and description]
    Signed-off-by: Manivannan Sadhasivam <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Signed-off-by: Krzysztof Wilczyński <[email protected]>
    Cc: [email protected]

Signed-off-by: Myron Stowe <[email protected]>

Author: Myron Stowe

drivers/pci/endpoint/pci-epc-core.c

@@ -837,11 +837,10 @@ EXPORT_SYMBOL_GPL(pci_epc_bus_master_enable_notify);
 void pci_epc_destroy(struct pci_epc *epc)
 {
 	pci_ep_cfs_remove_epc_group(epc->group);
-	device_unregister(&epc->dev);
-
 #ifdef CONFIG_PCI_DOMAINS_GENERIC
-	pci_bus_release_domain_nr(&epc->dev, epc->domain_nr);
+	pci_bus_release_domain_nr(epc->dev.parent, epc->domain_nr);
 #endif
+	device_unregister(&epc->dev);
 }
 EXPORT_SYMBOL_GPL(pci_epc_destroy);