[PATCH v1] octeontx2-af: Fix PCI device reference leaks in debugfs

[PATCH v1] octeontx2-af: Fix PCI device reference leaks in debugfs

[Yuho Choi]

cgx_print_stats(), cgx_print_dmac_flt(), and cgx_print_fwdata()
look up the RVU AF device with pci_get_device() and pass the returned
pointer directly to pci_get_drvdata().  pci_get_device() returns a PCI
device with an elevated reference count, so the lookup reference is
leaked on every debugfs read.

Store the returned PCI device pointer, check it before reading driver
data, and release the lookup reference after pci_get_drvdata(). In
cgx_print_dmac_flt(), release the AF lookup reference before reusing
pdev for pci_get_domain_bus_and_slot().

Fixes: f967488d095e ("octeontx2-af: Add per CGX port level NIX Rx/Tx counters")
Fixes: dbc52debf95f ("octeontx2-af: Debugfs support for DMAC filters")
Fixes: 49f02e6877d1 ("Octeontx2-af: Debugfs support for firmware data")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 .../marvell/octeontx2/af/rvu_debugfs.c        | 31 +++++++++++++++----
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index fa461489acdd..a94c48e9acc6 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -2838,9 +2838,16 @@ static int cgx_print_stats(struct seq_file *s, int lmac_id)
 	int stat = 0, err = 0;
 	u64 tx_stat, rx_stat;
 	struct rvu *rvu;
+	struct pci_dev *pdev = NULL;
+
+	pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
+			      PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
+	if (!pdev)
+		return -ENODEV;
+
+	rvu = pci_get_drvdata(pdev);
+	pci_dev_put(pdev);
 
-	rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
-					     PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
 	if (!rvu)
 		return -ENODEV;
 
@@ -2958,8 +2965,13 @@ static int cgx_print_dmac_flt(struct seq_file *s, int lmac_id)
 	u64 cfg, mac;
 	int pf;
 
-	rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
-					     PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
+	pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
+				 PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
+	if (!pdev)
+		return -ENODEV;
+
+	rvu = pci_get_drvdata(pdev);
+	pci_dev_put(pdev);
 	if (!rvu)
 		return -ENODEV;
 
@@ -3014,9 +3026,16 @@ static int cgx_print_fwdata(struct seq_file *s, int lmac_id)
 	struct phy_s *phy;
 	struct rvu *rvu;
 	int cgx_id, i;
+	struct pci_dev *pdev = NULL;
+
+	pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM,
+			      PCI_DEVID_OCTEONTX2_RVU_AF, NULL);
+	if (!pdev)
+		return -ENODEV;
+
+	rvu = pci_get_drvdata(pdev);
+	pci_dev_put(pdev);
 
-	rvu = pci_get_drvdata(pci_get_device(PCI_VENDOR_ID_CAVIUM,
-					     PCI_DEVID_OCTEONTX2_RVU_AF, NULL));
 	if (!rvu)
 		return -ENODEV;
 
-- 
2.43.0

Re: [PATCH v1] octeontx2-af: Fix PCI device reference leaks in debugfs

[Jakub Kicinski]

On Fri, 29 May 2026 01:23:33 -0400 Yuho Choi wrote:
> Subject: [PATCH v1] octeontx2-af: Fix PCI device reference leaks in debugfs
> Date: Fri, 29 May 2026 01:23:33 -0400
> X-Mailer: git-send-email 2.43.0
> 
> cgx_print_stats(), cgx_print_dmac_flt(), and cgx_print_fwdata()
> look up the RVU AF device with pci_get_device() and pass the returned
> pointer directly to pci_get_drvdata().  pci_get_device() returns a PCI
> device with an elevated reference count, so the lookup reference is
> leaked on every debugfs read.
> 
> Store the returned PCI device pointer, check it before reading driver
> data, and release the lookup reference after pci_get_drvdata(). In
> cgx_print_dmac_flt(), release the AF lookup reference before reusing
> pdev for pci_get_domain_bus_and_slot().

Looks like cgx struct has a pointer to the pci dev.
Can we use that instead?

When you repost please add net-next to the subject:

[PATCH net-next v2] octeontx2-af: Fix ...

and make sure you base the change on the net-next tree
For some reason our CI wasn't able to ingest this change.
-- 
pw-bot: cr

Re: [PATCH v1] octeontx2-af: Fix PCI device reference leaks in debugfs

[최유호]

Thanks for your time to review.

On Mon, 1 Jun 2026 at 22:02, Jakub Kicinski <kuba@kernel.org> wrote:

> Looks like cgx struct has a pointer to the pci dev.
> Can we use that instead?

I looked into that. While struct cgx does contain a pdev pointer, it
points to the CGX/RPM PCI device rather than the RVU AF device.

Its driver data is struct cgx, as cgx_probe() does:

    cgx->pdev = pdev;
    pci_set_drvdata(pdev, cgx);

The debugfs callbacks here need the RVU AF private data (struct rvu) for
rvu_cgx_nix_cuml_stats(), cgxlmac_to_pf(), and rvu->fwdat. Therefore
calling pci_get_drvdata(cgx->pdev) would return struct cgx rather than
struct rvu.

Unless I'm missing another path to reach the AF device from struct cgx,
it seems we still need to obtain the RVU AF pdev before calling
pci_get_drvdata().

> When you repost please add net-next to the subject:
>
> [PATCH net-next v2] octeontx2-af: Fix ...
>
> and make sure you base the change on the net-next tree
> For some reason our CI wasn't able to ingest this change.

Understood. I'll apply this for v2.