[PATCH] PCI/IOV: Fix peer device reference leak in sriov_init()

[PATCH] PCI/IOV: Fix peer device reference leak in sriov_init()

[Wentao Liang]

sriov_init() takes a reference to the SR-IOV physical function device
with pci_dev_get() and stores it in iov->dev.  If the subsequent
compute_max_vf_buses() call fails, the fail_max_buses path frees iov
without dropping that reference, unlike sriov_release() which puts
iov->dev on the normal teardown path.

Drop the reference on the fail_max_buses path as well.

Fixes: ea9a8854161d ("PCI: Set SR-IOV NumVFs to zero after enumeration")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/pci/iov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index 91ac4e37ecb9..f0687fe8514a 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -907,6 +907,8 @@ static int sriov_init(struct pci_dev *dev, int pos)
 fail_max_buses:
 	dev->sriov = NULL;
 	dev->is_physfn = 0;
+	if (pdev)
+		pci_dev_put(pdev);
 failed:
 	for (i = 0; i < PCI_SRIOV_NUM_BARS; i++) {
 		res = &dev->resource[pci_resource_num_from_vf_bar(i)];
-- 
2.34.1

Re: [PATCH] PCI/IOV: Fix peer device reference leak in sriov_init()

[sashiko-bot]

> sriov_init() takes a reference to the SR-IOV physical function device
> with pci_dev_get() and stores it in iov->dev.  If the subsequent
> compute_max_vf_buses() call fails, the fail_max_buses path frees iov
> without dropping that reference, unlike sriov_release() which puts
> iov->dev on the normal teardown path.
> 
> Drop the reference on the fail_max_buses path as well.
> 
> Fixes: ea9a8854161d ("PCI: Set SR-IOV NumVFs to zero after enumeration")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917132745.2153341-1-vulab@iscas.ac.cn?part=1