From 5d12c51bd98cdb5a32cbfb606963b05740ec42f2 Mon Sep 17 00:00:00 2001 From: Ruoyu Wang Date: Thu, 20 Aug 2026 21:56:03 +0800 Subject: [PATCH] xen/pcifront: Fix PCI device reference leak in AER handling pci_get_domain_bus_and_slot() increments the reference count of the returned PCI device. pcifront_common_process() drops that reference only when the device or its driver is missing. All paths for a bound device either return directly after invoking an error recovery callback or fall through without calling pci_dev_put(). Consequently, each AER request for a bound device leaks a reference and can keep the device allocated after removal. Declare the looked-up device with __free(pci_dev_put), so every return path releases the reference after callback dispatch. This keeps the device alive while its callback runs and balances the lookup without restructuring the callback returns. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.") Suggested-by: Lukas Wunner Signed-off-by: Ruoyu Wang Reviewed-by: Lukas Wunner Link: https://lore.kernel.org/r/20260813153138.3953222-1-ruoyuw560@gmail.com/ Signed-off-by: Juergen Gross Message-ID: <20260820135603.3901798-1-ruoyuw560@gmail.com> --- drivers/pci/xen-pcifront.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c index cffc32d66032..0dea8a69fa36 100644 --- a/drivers/pci/xen-pcifront.c +++ b/drivers/pci/xen-pcifront.c @@ -579,16 +579,15 @@ static pci_ers_result_t pcifront_common_process(int cmd, int bus = pdev->sh_info->aer_op.bus; int devfn = pdev->sh_info->aer_op.devfn; int domain = pdev->sh_info->aer_op.domain; - struct pci_dev *pcidev; + struct pci_dev *pcidev __free(pci_dev_put) = + pci_get_domain_bus_and_slot(domain, bus, devfn); dev_dbg(&pdev->xdev->dev, "pcifront AER process: cmd %x (bus:%x, devfn%x)", cmd, bus, devfn); - pcidev = pci_get_domain_bus_and_slot(domain, bus, devfn); if (!pcidev || !pcidev->dev.driver) { dev_err(&pdev->xdev->dev, "device or AER driver is NULL\n"); - pci_dev_put(pcidev); return PCI_ERS_RESULT_NONE; } pdrv = to_pci_driver(pcidev->dev.driver);