From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794047512; b=SnB/OHV9OOTdk0NhlvyR3I3lq30u19mVHlsTnblPVP11Mtu7WecYh3NhYbzDhKyti3LD Q6BSAbLb60cLSm0/fo0vsLTtUHaOI5d9bBsbVf4I4LjYNbqLSvosUo5uTQVNTlgxYd5wR Wzt3eR/1tE6FjTxBLkZX3x/Q1MhgpsPudvrHfFxjQxX+fwqnu5nK+BbSnLWYKIze3ODxr ou4yRJtNrKSzv+CWZ9lBRY6wMOAu4FZ6cna8V3C250PfotcwCDm4MYCT9nm6Vw6hAiUhy cgdAC5eH7t3ZxwtsbpMxdh9MLFFUM+h7qbE/OdEuw1MkGlcDc+fxW0NwKAnypFSJt/A== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794047512; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=Il2AmTb/pe1LknwJ/abheOS14j65J27DHWBNSu0M1ZM=; b=bf0HRQIzWvb67TIeag1HvdMU+rsx9n5CDxzzSi069JpCTkAgG5WWdekU2gK008fLvii4 NFjj09iB1NCEDV02abO+GW7BUGwNy5dAwJw6SPqoFj4jfMXIaHfWGbUW9jpFX05R3PjJg fSpcAphs3BVi3cggFpadjQPEYTuXRhmgM5ytjc/ctPTKmX5BL9zyCTO3DRwJABUb/D3ot fqBH3lY8MBQr+cb9u3NTwhhPbb3uKAbGtGesm1Z+O96J8GWXK1agvg/uLIx5yhMvU1YxN dQvQh3R6vVm5gZ2dv5CqVeFKM1lJO3hcX1VPWf6c8Bgm7AickKfVNIFy68EfMml2T/Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=hlgfaXO8; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0F88A606D813 for ; Sat, 7 Nov 2026 10:31:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=hlgfaXO8 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6993C1F0089F; Sat, 7 Nov 2026 10:31:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794047511; bh=Il2AmTb/pe1LknwJ/abheOS14j65J27DHWBNSu0M1ZM=; h=From:To:Cc:Subject:Date; b=hlgfaXO8sm5cZNyKcpWHS/k9+GjnQAMTIHc/aj4hS7cg47NwR+CCSh/eHqSwdHc+i RARK14N8wxyRWPjzsUcPv11NEUORNpRkUpxfTeZW/9L/HCVSUkpU/nsraevG2stDMx 2eUgsxM//7VwLVfxkpP6FbQpx+0jPc+qYG/qiwgo0Y+xIppcGeyaBDympQaNJBgfoE fJv0+Vn4Pbs6+uZGCpdmqU6hLUXz2cbXyYuadBv3VIiSrn2VMfEirtXkz4yYMmxJ5i 75MM7qnwoFOZT0jxZ1tdF8R4IM966xhLPG4G2HxPZRoXoQ2wnt3kO3InJo9h/z/twh df8iyltTPOSiA== From: Sasha Levin To: rathodpriyank@google.com, bhelgaas@google.com, sathyanarayanan.kuppuswamy@linux.intel.com Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] PCI/AER: Fix memory leak in aer_recover_work_func() when pci_dev is missing" failed to apply to 6.6-stable tree Date: Sat, 7 Nov 2026 05:31:50 -0500 Message-ID: <20261107053150-failed-6.6-d4c842c3af5b@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.6-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y git checkout FETCH_HEAD git cherry-pick -x d4c842c3af5bc52b3ca0b8a7f116114e43b6ba44 # git commit -s git send-email --to '' --in-reply-to '20261107053150-failed-6.6-d4c842c3af5b@kernel.org' --subject-prefix 'PATCH 6.6.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From d4c842c3af5bc52b3ca0b8a7f116114e43b6ba44 Mon Sep 17 00:00:00 2001 From: Priyank Rathod Date: Mon, 28 Sep 2026 17:40:13 +0000 Subject: [PATCH] PCI/AER: Fix memory leak in aer_recover_work_func() when pci_dev is missing When ACPI APEI/GHES processes PCIe AER error records, it allocates memory for aer_capability_regs (entry.regs) from ghes_estatus_pool and queues the entry into aer_recover_ring. In aer_recover_work_func(), items are popped from aer_recover_ring via kfifo_get(). If pci_get_domain_bus_and_slot() fails to find a matching pci_dev, the code previously executed 'continue', bypassing the call to ghes_estatus_pool_region_free(). As a result, the memory allocated for entry.regs from ghes_estatus_pool was leaked. This is reachable whenever the device reported by firmware is not (or is no longer) present in the PCI device tree, e.g. after hot-removal or when firmware reports an error for a device the kernel never enumerated. Refactor aer_recover_work_func() to ensure ghes_estatus_pool_region_free() is called unconditionally for every dequeued entry, releasing the pool memory even when pci_dev is missing. Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status data has multiple sections") Signed-off-by: Priyank Rathod Signed-off-by: Bjorn Helgaas Reviewed-by: Kuppuswamy Sathyanarayanan Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260928-b4-fix-aer-memleaks-v5-2-ba6b94c9c9a6@google.com --- drivers/pci/pcie/aer.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c index b013b853b5555..a6600801af6e4 100644 --- a/drivers/pci/pcie/aer.c +++ b/drivers/pci/pcie/aer.c @@ -1366,14 +1366,13 @@ static void aer_recover_work_func(struct work_struct *work) while (kfifo_get(&aer_recover_ring, &entry)) { pdev = pci_get_domain_bus_and_slot(entry.domain, entry.bus, entry.devfn); - if (!pdev) { + if (!pdev) pr_err_ratelimited("%04x:%02x:%02x.%x: no pci_dev found\n", entry.domain, entry.bus, PCI_SLOT(entry.devfn), PCI_FUNC(entry.devfn)); - continue; - } - pci_print_aer(pdev, entry.severity, entry.regs); + else + pci_print_aer(pdev, entry.severity, entry.regs); /* * Memory for aer_capability_regs(entry.regs) is being @@ -1385,13 +1384,15 @@ static void aer_recover_work_func(struct work_struct *work) ghes_estatus_pool_region_free((unsigned long)entry.regs, sizeof(struct aer_capability_regs)); - if (entry.severity == AER_NONFATAL) - pcie_do_recovery(pdev, pci_channel_io_normal, - aer_root_reset); - else if (entry.severity == AER_FATAL) - pcie_do_recovery(pdev, pci_channel_io_frozen, - aer_root_reset); - pci_dev_put(pdev); + if (pdev) { + if (entry.severity == AER_NONFATAL) + pcie_do_recovery(pdev, pci_channel_io_normal, + aer_root_reset); + else if (entry.severity == AER_FATAL) + pcie_do_recovery(pdev, pci_channel_io_frozen, + aer_root_reset); + pci_dev_put(pdev); + } } } -- 2.53.0