[PATCH] PCI/IOV: Drop device reference on sriov_init() failure

[PATCH] PCI/IOV: Drop device reference on sriov_init() failure

[Haoxiang Li]

sriov_init() takes a reference to another PF device with pci_dev_get()
when an existing PF is found on the bus. If compute_max_vf_buses() fails
afterwards, the error path clears dev->sriov and frees the pci_sriov
structure, but does not drop that reference.

Release iov->dev before freeing iov on the error path, matching the
cleanup done by sriov_release().

Fixes: ea9a8854161d ("PCI: Set SR-IOV NumVFs to zero after enumeration")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
 drivers/pci/iov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index 91ac4e37ecb9..1a55863fa7a0 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -905,6 +905,8 @@ static int sriov_init(struct pci_dev *dev, int pos)
 	return 0;
 
 fail_max_buses:
+	if (iov->dev != dev)
+		pci_dev_put(iov->dev);
 	dev->sriov = NULL;
 	dev->is_physfn = 0;
 failed:
-- 
2.25.1

Re: [PATCH] PCI/IOV: Drop device reference on sriov_init() failure

[sashiko-bot]

> sriov_init() takes a reference to another PF device with pci_dev_get()
> when an existing PF is found on the bus. If compute_max_vf_buses() fails
> afterwards, the error path clears dev->sriov and frees the pci_sriov
> structure, but does not drop that reference.
> 
> Release iov->dev before freeing iov on the error path, matching the
> cleanup done by sriov_release().
> 
> Fixes: ea9a8854161d ("PCI: Set SR-IOV NumVFs to zero after enumeration")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260622093132.910859-1-haoxiang_li2024@163.com?part=1