From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590136; b=RPTam/lftVh1Z+0MpnawoZxBYu3EOR5TYPPbyVypsrMNXCR/8AP/UU1hNhKBSIIeoQZD S8TfiuC0ih8momDjE2Nu7bYtrGibz8o7BrJi5DGh5xG6PI9ySQB64Ey1fRGTFxjaVG9KK 1E4x6FDzt06gpWA9G5GTtB4d82Tl1EydmmY7RFv5ABE0tX9PdYA6md0g7nJQa7ufZMdz4 QDq1kCsB65K3y/8KyPwMHQyamo5KK/bOdP59u66XqEq927pSm8/2n2lnSAXhv6Ck2Aohg huDP+5D3CnlxOAMFYe9zMAhJuHA8UE5QVGMgQqNU9Giah+E+TVk/RahQdKpKpSEyutw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590136; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=fTQLgODGj7DQ9mk5/rGao5JCaa1PS+fcwyXFmeyxSTk=; b=Gad19RrvBH+T9lzs7ThCt5E6ZpBM0biLv6IVhKSrTpJr4lc4HUTFTSHtko0zLQd0qR2z 77D9bwaO+NRBrP3YhVEZyzf4D5ZrRM74C8uHe/PDDPuvws5VALAwvTdHlk0vBtNVVkqnP uZzTBWpHBqUAm5QNicSuNDbKbxv51pH+xBBOmosqPuSDcrA2KfOOqvlNuBqo6xkpzWls5 O92gIgjQZAhrjQTRBK2ljFbssXU2ve3DWXXgh+F12vwviZxh4w8Z4E0cP0v8+WPaBUeOn lhHf1lUC5IsSS8g68YsE9bI+mkdK9XV7j6rc8Vs/XK+OqRmTncaAg9WE+1CjW89n1sA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=kTI3+sEV; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AACAC606E200; Fri, 13 Nov 2026 17:15:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=kTI3+sEV Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5717B1F000C9; Fri, 13 Nov 2026 17:15:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590136; bh=fTQLgODGj7DQ9mk5/rGao5JCaa1PS+fcwyXFmeyxSTk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=kTI3+sEVcdQLoWNmSXIYNVJWg+mW9h8GThNryax76wOVIG0v4oCNE+BURr/qAA8xI aV9uZU0iXmxxYRPl1gVGO1BVD8g0YZMaEiT/FULAbJAkIJAKK1yzlRjPQW/VFbKbd1 XDtCt1oOJ0xpdaWOo55h+fj4/Yd75pJcWzlv7wiE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Priyank Rathod , Bjorn Helgaas , Kuppuswamy Sathyanarayanan , Sasha Levin Subject: [PATCH 6.18 155/686] PCI/AER: Fix memory leak in aer_recover_work_func() when pci_dev is missing Date: Fri, 13 Nov 2026 10:44:48 -0500 Message-ID: <20261113153826.046757746@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Priyank Rathod [ Upstream commit d4c842c3af5bc52b3ca0b8a7f116114e43b6ba44 ] When ACPI APEI/GHES processes PCIe AER error records, it allocates memory for aer_capability_regs (entry.regs) from ghes_estatus_pool and queues the entry into aer_recover_ring. In aer_recover_work_func(), items are popped from aer_recover_ring via kfifo_get(). If pci_get_domain_bus_and_slot() fails to find a matching pci_dev, the code previously executed 'continue', bypassing the call to ghes_estatus_pool_region_free(). As a result, the memory allocated for entry.regs from ghes_estatus_pool was leaked. This is reachable whenever the device reported by firmware is not (or is no longer) present in the PCI device tree, e.g. after hot-removal or when firmware reports an error for a device the kernel never enumerated. Refactor aer_recover_work_func() to ensure ghes_estatus_pool_region_free() is called unconditionally for every dequeued entry, releasing the pool memory even when pci_dev is missing. Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status data has multiple sections") Signed-off-by: Priyank Rathod Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260928-b4-fix-aer-memleaks-v5-2-ba6b94c9c9a6@google.com Signed-off-by: Sasha Levin --- drivers/pci/pcie/aer.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c index ad3fea4b56f88..9ded8dacb62c9 100644 --- a/drivers/pci/pcie/aer.c +++ b/drivers/pci/pcie/aer.c @@ -1330,14 +1330,13 @@ static void aer_recover_work_func(struct work_struct *work) while (kfifo_get(&aer_recover_ring, &entry)) { pdev = pci_get_domain_bus_and_slot(entry.domain, entry.bus, entry.devfn); - if (!pdev) { + if (!pdev) pr_err_ratelimited("%04x:%02x:%02x.%x: no pci_dev found\n", entry.domain, entry.bus, PCI_SLOT(entry.devfn), PCI_FUNC(entry.devfn)); - continue; - } - pci_print_aer(pdev, entry.severity, entry.regs); + else + pci_print_aer(pdev, entry.severity, entry.regs); /* * Memory for aer_capability_regs(entry.regs) is being @@ -1349,13 +1348,15 @@ static void aer_recover_work_func(struct work_struct *work) ghes_estatus_pool_region_free((unsigned long)entry.regs, sizeof(struct aer_capability_regs)); - if (entry.severity == AER_NONFATAL) - pcie_do_recovery(pdev, pci_channel_io_normal, - aer_root_reset); - else if (entry.severity == AER_FATAL) - pcie_do_recovery(pdev, pci_channel_io_frozen, - aer_root_reset); - pci_dev_put(pdev); + if (pdev) { + if (entry.severity == AER_NONFATAL) + pcie_do_recovery(pdev, pci_channel_io_normal, + aer_root_reset); + else if (entry.severity == AER_FATAL) + pcie_do_recovery(pdev, pci_channel_io_frozen, + aer_root_reset); + pci_dev_put(pdev); + } } } -- 2.53.0