From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 993FB3290D9 for ; Thu, 20 Aug 2026 13:56:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787234172; cv=none; b=C629dVoAczTWuMS99zEdPZs2XP2itudO03IdovTjP1X6IjL1iNWkck1l+ktUpCeDP5Vw6LVtMQxfjqtIXdiBJJdjygb8H9B3A63ObBhbqtClyfKkPYNeI6JHr5OdVYFn9nYwV4BmO+5DIFRYtAJdMbdkzq/iazvjkNK8OvcPAI4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787234172; c=relaxed/simple; bh=4pr3sHs9f3HNQ9zhlHQOFNT+yyTq5K9eOIDJaMqckd4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EKaBcfHMZPFjyda+lCA0kjhGVPR73p3CcEmA2Y9mm19K2yYd8dqT0aFg+7WmjY2tCrKiRd8XOo14lqLxPtZBlrTa2vj8upNGvswdk1J6DPk5O+q0GLjZgufbIC3DU6ITEZg65436p1L2oylo1O4FsV/HHOGG410Ub59d8C/rcjo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=H92mB2ib; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="H92mB2ib" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3856d6fbcb3so2078289a91.2 for ; Thu, 20 Aug 2026 06:56:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787234171; x=1787838971; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=IK7VtHj+yeJrnKBH2mt3PEgztVO6LVM/yM8XqEcV4BY=; b=H92mB2ibiYVd1BJk6KTZOY6WLfZczFf5CxFBEKrNil4E+1iazFCtwT+FPkj/9+6Hj6 Z+AEiSKN+zLapRavS+NouWixjwAHj9+6jzOV8dFsA5woOWtLR8zBiftRcDs0wHxdqqVH 7A24qGSIQ7DRbmCYWSo/cdsmeVgSKwa4+vzMWxV760dvaMtTj5bSbBg+cDkl3y3gDf5j P9/YO0++rJgFgpHEauzqSamNnHvylMvfXDO4UjPG/ebROjXcgeDpHUzu21NKi8L8j2eY ccGnhgiTmgcWJNdiMzniGhtBW8npG5Ug55XoF6QBciXdsZd4jTmpKBSA4wLMZmqyChHn GQFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787234171; x=1787838971; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IK7VtHj+yeJrnKBH2mt3PEgztVO6LVM/yM8XqEcV4BY=; b=SYXYvcz8BckVr5Uo/yOupCteJIB2l9tOUO05PlFDV94WL0iyLxZE5eQVmG3120YtF9 sbW0vVrZQvP2Sb3lnc+0LJOaW1m6z+JqMw4yGyLRh4y0RROHqjlAhei92f7JfwUkSZEg EcNCWgh4Afl0o0yb1Fp6G9GSHTsoYuYmB7vGNhJUxH/Ils/yex43v3NaNxUzWp+YUeFZ QmbIrl44yrbTjIwbGUe6Qs5efAJd5pv8Q9xF3yFwKWl9vqG3mnnRBh1vwghNsgZePnCy siooc7veRB85FLnipytwO6EE0N0DWcngqIvbgAvrtX+vdHK7c1ll83cj29ekfLZ3kug5 eJDg== X-Forwarded-Encrypted: i=1; AHgh+RomyNuwbyCRCLOvygfptUocxOl2lzPBq8zaOesVlHiRWtzp/i8o6m1UgIBQAZHkuwXCtqwVGFMmP0IMc00=@vger.kernel.org X-Gm-Message-State: AFuF++l0Ba4XI0lAMnB43JO/biBcDF+0Id6IyFE2ttr9GMs99BfAL45y pMR6iKzu/g3Fm8rTsuwZA5QBx9yqrIhAlQw8kFRKijJeMtNDmxo5F202 X-Gm-Gg: AR+sD12plli+pxFzW9Bh0noXHSimAkZ9EDsNilcGB0jmEDZFxfE6GRPW2yIUTSAT4e1 8CSwfpCnhNbEc4l8dbTBuOoQF78zxk0/UzkKwyOwOgadtAgNHn9Z7BZoOhmsGnztyFeDs3uoz2Z HE2hdHlJqetiuyV0MgG+pcePGQ8lRN+o6gO0usRVoFtL7wsPD7oeizAd2QyfsxaEmSekRamaN7s lBUq8/MH0IvW6GARMzAPumvjDdjNLwjA8PRZQlbZ1eEaKigpmWAv5161Y4lh67ITAd6snn5MSMk 7h33aCJfCpyJ1oOAPO2CBEoDOFz40hn+YG3i1HTvM3H5ASmG0x3NyMlTn4o+FGxuZFSQzVHl6ru oX6q2krQRRLh6s+/Q9C5clt91AHrTWgSPqG49h14QcosTEIjM6mL0PCkncXcXCCg1U2iSDXUYUs 8wt7srUpHxfbw178yVRSJ7WUOfUSyiR/oscTERu6Rsit179CSfjdrsLh0eh+pDtsmyDUJ3uQNoz 3dcNhDo X-Received: by 2002:a17:90b:2d05:b0:380:21b7:e727 with SMTP id 98e67ed59e1d1-39581470f03mr25148158a91.14.1787234170841; Thu, 20 Aug 2026 06:56:10 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:85a4:b9cf:b578:4307]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3957f9ab4b4sm6653893a91.8.2026.08.20.06.56.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 06:56:10 -0700 (PDT) From: Ruoyu Wang To: Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , Bjorn Helgaas , Konrad Rzeszutek Wilk , Jan Beulich , Lukas Wunner Cc: xen-devel@lists.xenproject.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH v2] xen/pcifront: Fix PCI device reference leak in AER handling Date: Thu, 20 Aug 2026 21:56:03 +0800 Message-ID: <20260820135603.3901798-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit pci_get_domain_bus_and_slot() increments the reference count of the returned PCI device. pcifront_common_process() drops that reference only when the device or its driver is missing. All paths for a bound device either return directly after invoking an error recovery callback or fall through without calling pci_dev_put(). Consequently, each AER request for a bound device leaks a reference and can keep the device allocated after removal. Declare the looked-up device with __free(pci_dev_put), so every return path releases the reference after callback dispatch. This keeps the device alive while its callback runs and balances the lookup without restructuring the callback returns. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.") Suggested-by: Lukas Wunner Signed-off-by: Ruoyu Wang --- Changes in v2: - Use __free(pci_dev_put) instead of restructuring the callback returns. Link: https://lore.kernel.org/r/20260813153138.3953222-1-ruoyuw560@gmail.com/ --- drivers/pci/xen-pcifront.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c index cffc32d660327..0dea8a69fa36c 100644 --- a/drivers/pci/xen-pcifront.c +++ b/drivers/pci/xen-pcifront.c @@ -579,16 +579,15 @@ static pci_ers_result_t pcifront_common_process(int cmd, int bus = pdev->sh_info->aer_op.bus; int devfn = pdev->sh_info->aer_op.devfn; int domain = pdev->sh_info->aer_op.domain; - struct pci_dev *pcidev; + struct pci_dev *pcidev __free(pci_dev_put) = + pci_get_domain_bus_and_slot(domain, bus, devfn); dev_dbg(&pdev->xdev->dev, "pcifront AER process: cmd %x (bus:%x, devfn%x)", cmd, bus, devfn); - pcidev = pci_get_domain_bus_and_slot(domain, bus, devfn); if (!pcidev || !pcidev->dev.driver) { dev_err(&pdev->xdev->dev, "device or AER driver is NULL\n"); - pci_dev_put(pcidev); return PCI_ERS_RESULT_NONE; } pdrv = to_pci_driver(pcidev->dev.driver); -- 2.51.0