[PATCH] fix: drivers/video: __screen_info_pci_dev: leaked pci_dev references in pci_get_base_class loop

[PATCH] fix: drivers/video: __screen_info_pci_dev: leaked pci_dev references in pci_get_base_class loop

[WenTao Liang]

In __screen_info_pci_dev(), the loop uses pci_get_base_class() with a
non-NULL starting device pdev. Each iteration returns a new device
reference but does not release the previous one. When a non-matching
device is found, pdev is overwritten and the previous reference leaks.
When no match is found, all acquired references are leaked.

Add pci_dev_put(pdev) for non-matching devices before continuing the loop.

Cc: stable@vger.kernel.org
Fixes: 036105e3a776 ("video: Provide screen_info_get_pci_dev() to find screen_info's PCI device")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/video/screen_info_pci.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/screen_info_pci.c b/drivers/video/screen_info_pci.c
index 8f34d8a74f09..c821101e9304 100644
--- a/drivers/video/screen_info_pci.c
+++ b/drivers/video/screen_info_pci.c
@@ -123,6 +123,10 @@ static struct pci_dev *__screen_info_pci_dev(struct resource *res)
 
 	while (!r && (pdev = pci_get_base_class(PCI_BASE_CLASS_DISPLAY, pdev))) {
 		r = pci_find_resource(pdev, res);
+		if (!r) {
+			pci_dev_put(pdev);
+			pdev = NULL;
+		}
 	}
 
 	return pdev;
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] fix: drivers/video: __screen_info_pci_dev: leaked pci_dev references in pci_get_base_class loop

[Helge Deller]

On 6/27/26 05:44, WenTao Liang wrote:
> In __screen_info_pci_dev(), the loop uses pci_get_base_class() with a
> non-NULL starting device pdev. Each iteration returns a new device
> reference but does not release the previous one. When a non-matching
> device is found, pdev is overwritten and the previous reference leaks.
> When no match is found, all acquired references are leaked.
> 
> Add pci_dev_put(pdev) for non-matching devices before continuing the loop.
> 
> Cc: stable@vger.kernel.org
> Fixes: 036105e3a776 ("video: Provide screen_info_get_pci_dev() to find screen_info's PCI device")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/video/screen_info_pci.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/video/screen_info_pci.c b/drivers/video/screen_info_pci.c
> index 8f34d8a74f09..c821101e9304 100644
> --- a/drivers/video/screen_info_pci.c
> +++ b/drivers/video/screen_info_pci.c
> @@ -123,6 +123,10 @@ static struct pci_dev *__screen_info_pci_dev(struct resource *res)
>   
>   	while (!r && (pdev = pci_get_base_class(PCI_BASE_CLASS_DISPLAY, pdev))) {
>   		r = pci_find_resource(pdev, res);
> +		if (!r) {
> +			pci_dev_put(pdev);
> +			pdev = NULL;
> +		}

Have you tested the code?
If pdev gets assigned NULL, doesn't that introduce an endless loop?
And, similar code is in amdgpu*  and google's framebuffer-coreboot.c files, so if
this is correct, don't they need fixing as well?

Helge

Re: [PATCH] fix: drivers/video: __screen_info_pci_dev: leaked pci_dev references in pci_get_base_class loop

[Jani Nikula]

On Sat, 27 Jun 2026, Helge Deller <deller@gmx.de> wrote:
> On 6/27/26 05:44, WenTao Liang wrote:
>> In __screen_info_pci_dev(), the loop uses pci_get_base_class() with a
>> non-NULL starting device pdev. Each iteration returns a new device
>> reference but does not release the previous one. When a non-matching
>> device is found, pdev is overwritten and the previous reference leaks.
>> When no match is found, all acquired references are leaked.
>> 
>> Add pci_dev_put(pdev) for non-matching devices before continuing the loop.
>> 
>> Cc: stable@vger.kernel.org
>> Fixes: 036105e3a776 ("video: Provide screen_info_get_pci_dev() to find screen_info's PCI device")
>> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
>> ---
>>   drivers/video/screen_info_pci.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>> 
>> diff --git a/drivers/video/screen_info_pci.c b/drivers/video/screen_info_pci.c
>> index 8f34d8a74f09..c821101e9304 100644
>> --- a/drivers/video/screen_info_pci.c
>> +++ b/drivers/video/screen_info_pci.c
>> @@ -123,6 +123,10 @@ static struct pci_dev *__screen_info_pci_dev(struct resource *res)
>>   
>>   	while (!r && (pdev = pci_get_base_class(PCI_BASE_CLASS_DISPLAY, pdev))) {
>>   		r = pci_find_resource(pdev, res);
>> +		if (!r) {
>> +			pci_dev_put(pdev);
>> +			pdev = NULL;
>> +		}
>
> Have you tested the code?
> If pdev gets assigned NULL, doesn't that introduce an endless loop?
> And, similar code is in amdgpu*  and google's framebuffer-coreboot.c files, so if
> this is correct, don't they need fixing as well?

More specifically, pci_get_base_class() decrements the passed in "from"
refcount if it's not NULL.

BR,
Jani.


-- 
Jani Nikula, Intel