[PATCH] iommu/amd: Put PCI device after handling PPR faults

[PATCH] iommu/amd: Put PCI device after handling PPR faults

[Shuai Xue]

iommu_call_iopf_notifier() looks up the requester with
pci_get_domain_bus_and_slot(), which returns a PCI device with its
reference count incremented.

Neither the successful iommu_report_device_fault() path nor the abort
path drops that reference, so every handled PPR request leaks a PCI
device reference.

This is the same ownership rule that was fixed for the old iommu_v2
ppr_notifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device
refcount leak in ppr_notifier()"), but iommu_call_iopf_notifier() was
added later as a separate PPR/IOPF notifier path.

Drop the PCI device reference after handling the PPR entry.

Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler")
Cc: stable@vger.kernel.org
Assisted-by: Qoder:Qwen-3.8-MAX-Preview
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
---
 drivers/iommu/amd/ppr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c
index 1f8d2823bea4..80369ca1e316 100644
--- a/drivers/iommu/amd/ppr.c
+++ b/drivers/iommu/amd/ppr.c
@@ -151,7 +151,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
 
 	/* Submit event */
 	iommu_report_device_fault(&pdev->dev, &event);
-
+	pci_dev_put(pdev);
 	return;
 
 out:
@@ -159,6 +159,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
 	amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]),
 			       IOMMU_PAGE_RESP_FAILURE,
 			       PPR_TAG(raw[0]) & 0x1FF);
+	pci_dev_put(pdev);
 }
 
 void amd_iommu_poll_ppr_log(struct amd_iommu *iommu)
-- 
2.39.3

Re: [PATCH] iommu/amd: Put PCI device after handling PPR faults

[Vasant Hegde]

On 7/27/2026 8:32 AM, Shuai Xue wrote:
> iommu_call_iopf_notifier() looks up the requester with
> pci_get_domain_bus_and_slot(), which returns a PCI device with its
> reference count incremented.
> 
> Neither the successful iommu_report_device_fault() path nor the abort
> path drops that reference, so every handled PPR request leaks a PCI
> device reference.
> 
> This is the same ownership rule that was fixed for the old iommu_v2
> ppr_notifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device
> refcount leak in ppr_notifier()"), but iommu_call_iopf_notifier() was
> added later as a separate PPR/IOPF notifier path.
> 
> Drop the PCI device reference after handling the PPR entry.
> 
> Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler")
> Cc: stable@vger.kernel.org
> Assisted-by: Qoder:Qwen-3.8-MAX-Preview
> Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>

Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>

-Vasant

Re: [PATCH] iommu/amd: Put PCI device after handling PPR faults

[Jörg Rödel]

On Mon, Jul 27, 2026 at 11:02:12AM +0800, Shuai Xue wrote:
>  drivers/iommu/amd/ppr.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Applied, thanks.