All of lore.kernel.org
 help / color / mirror / Atom feed
From: Simon Horman <horms@kernel.org>
To: Wentao Liang <vulab@iscas.ac.cn>
Cc: andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
	kuba@kernel.org, linux-kernel@vger.kernel.org,
	mchan@broadcom.com, netdev@vger.kernel.org, pabeni@redhat.com,
	pavan.chebbi@broadcom.com, stable@vger.kernel.org
Subject: Re: [PATCH] tg3: Fix peer device double put in tg3_find_peer()
Date: Sun, 20 Sep 2026 10:25:12 +0100	[thread overview]
Message-ID: <20260920092512.GA13925@horms.kernel.org> (raw)
In-Reply-To: <20260917105104.2147646-1-vulab@iscas.ac.cn>

On Thu, Sep 17, 2026 at 10:51:04AM +0000, Wentao Liang wrote:
> pci_get_slot() returns a device with its reference count incremented.
> When the loop ends on tp->pdev (which happens when the adapter sits at
> PCI function 7 and no other function is present) that reference has
> already been dropped inside the loop, but the trailing pci_dev_put()
> drops it a second time, underflowing the refcount of tp->pdev.
> 
> Treat a loop end on tp->pdev as single-port mode, just like the
> existing !peer case.
> 
> Fixes: 16fe9d74f14e ("[TG3]: Fix 5704 single-port mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Hi,

I agree with your analysis of the logic.
But I wonder if it can occur in practice:
can such a device actually be presented to the Kernel?

      reply	other threads:[~2026-09-20  9:25 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-17 10:51 [PATCH] tg3: Fix peer device double put in tg3_find_peer() Wentao Liang
2026-09-20  9:25 ` Simon Horman [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260920092512.GA13925@horms.kernel.org \
    --to=horms@kernel.org \
    --cc=andrew+netdev@lunn.ch \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mchan@broadcom.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=pavan.chebbi@broadcom.com \
    --cc=stable@vger.kernel.org \
    --cc=vulab@iscas.ac.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.