From nobody Fri Aug 28 00:49:35 2026 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37ACE48AE06 for ; Thu, 13 Aug 2026 15:31:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.176 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786635105; cv=none; b=PYuyZfR+6YcK1HNjisdMqcWHGrlOI0hAbFEbgdcXZbyvQhB1alk+o4d2SPH4zPHW5EL/Jm7cVPFSwBBj0qcXEfCRHAcOUpZivmigqYwCn444S3VkWIPuTqrc519OozActSkz9cNoAECfuODWhFVDHK6qqoTLFJCWL0sK6bTlEAg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786635105; c=relaxed/simple; bh=p8Cr//oDiUoJH0T79C9Z0a9JvVqIL+9+JAC/XJMhYsY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Chi84CKExmepFu08vhS2ODs2aKopMQh/7nVSl0HwszzOVj0UZ7UBtxqTxYJc5tHi4utQqabOymdBwGLitdeG7VHn/L70Cv0QoXvfp7GA6XntpReJUtx/dSSga7U9Gj8EZVIkUSjW+K8ZjCWMxnMvKBcHdSwL96bJR4t8Q55WnrQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XyUK8tZZ; arc=none smtp.client-ip=209.85.214.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XyUK8tZZ" Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2ceab75934dso701635ad.2 for ; Thu, 13 Aug 2026 08:31:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786635103; x=1787239903; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=5PO43KtK1vinlhveejSpb/w0mOz3aVvtFpKxNKIjn3Q=; b=XyUK8tZZdGTHi+Ib25XijnnP/UJNhItJ8xxGkoW6cIeyMOtwXuHHD3lW3lhPzhPNwo f9Ftw9SAQTW6kRtD2+p37VUox6icE8gdl98XB4AkpMkgMqVg7M7NC3PhyI2JdI20Ycdo mHpwq3CsRgcg1DscgTUchLxOFKkO3BiOTzyaJ5s3INO0NcIIVYgcK/f2bW8FzAhGksIs Yuta6i8Kv11y+U45cj8eZ5knUt2xF3sOSRQox5UGnOASkKxLXbC4pHqhyEtk8Ls69hW8 BVqKdoHbH1GtEB7/K9/rzwcysLwPsIBgXpmRap3Qm9rYDNeL4bRJ+ciwcBrEDWEYx0bU Nl7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786635103; x=1787239903; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=5PO43KtK1vinlhveejSpb/w0mOz3aVvtFpKxNKIjn3Q=; b=fya15XtPxWI0BIZArhYfcL7LgxuVoqAPwQ3OnxFnOi1hDefC6rIlcaAIVOB6E6x1oY EkDI9a38RH1arm9gCKf3Cp9HGDzCR5itO+uUqBRO+QfzOnjqebeOBWBhmq2KHT7RXADb koJzQ0W3htA+UWoeYhSycQS42m+NYmQIXZxuKSweFsqb5N6EohYz+RWXNVg7xsF/dnA9 b0dQJB9fn0LYR4JxtRIKJ7r4R+TtbjIZViyr045ZH3I8H/YJfTBKOLE+iXfD/NFqMRzW mjRT8Sv0voiW18pJFb13Wp/ZBydiATABpd9hLfBwDKRrDPjmKCwwjCtms6y/8ikMpuk4 /hig== X-Forwarded-Encrypted: i=1; AHgh+RqJbyvdSe0V/1sWLhm9h/32ECkNd8nDwDxhG0+AbvWKp9zUnv9hp3rzEZXROnFGb1JZKBk33mfA48TyIuc=@vger.kernel.org X-Gm-Message-State: AOJu0YwnyosZP7aqqFUFe5Kminzavs4U7kZX1/XVWiFe1KhigCspNX7c 8oVraW/6f+MPeMVZ9Y3sTrAFMmOJP8Rdz2WYqgtREWE3CLIc8SA02GDS X-Gm-Gg: AR+sD1002ZON2VdZBn69OYMBIilN8edySPGDhO3uziNAHI3yBwh+ZbtYFmVaTDM/kbm SPQDeld419hNw0FtBKaXM5WM6AF3I5x/xqfdaE6SgM517IGttd/OvwMNVGgBowzEYg7JPbLrM+Z tq2TgFy8l71ktuBpX8BgC3OxG877VmZ5TqbWh3QctftRj3Es7AU77RiBMq0YMlS9ZP3cM+goOn1 X5AAwYdrVTtplE4jivB/1TAVo+ri9Od9k1//ewAs80pIFLiQ1p1Tb4tz8JqnfcIYfLkBLmZQIWc ethVUPxMQbfu6TKIu1BTOGecxCkesK+oMjCelDKOTEaehqMKJGMdO0fHfGqDc/nKRkUuHgdrbOI Ej639iRH8vhh3i28CsOYQdfKXUkpQLU2psH9JqE0yhT+M92mwalwrVqxrH6Nyh+Bht+9GuMOsWN aIiFE/z/s6SgKlqksOr3MOVFiRH/HINr3WiIKFWLbllgeemF6CifPJ1daQqY+Zho+RA+qmA4YFj uirUFkE X-Received: by 2002:a17:902:ea0b:b0:2c9:9a19:df with SMTP id d9443c01a7336-2d37ebb174cmr71789975ad.18.1786635103360; Thu, 13 Aug 2026 08:31:43 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:3b7:6da1:c188:d14f]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d37c4e8098sm11911405ad.84.2026.08.13.08.31.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 08:31:42 -0700 (PDT) From: Ruoyu Wang To: xen-devel@lists.xenproject.org Cc: jgross@suse.com, sstabellini@kernel.org, oleksandr_tyshchenko@epam.com, bhelgaas@google.com, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] xen/pcifront: Fix PCI device reference leak in AER handling Date: Thu, 13 Aug 2026 23:31:38 +0800 Message-ID: <20260813153138.3953222-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" pci_get_domain_bus_and_slot() increments the reference count of the returned PCI device. pcifront_common_process() drops that reference only when the device or its driver is missing. All paths for a bound device either return directly after invoking an error recovery callback or fall through without calling pci_dev_put(). Consequently, each AER request for a bound device leaks a reference and can keep the device allocated after removal. Store the callback result, release the reference after callback dispatch, and then return the result. This keeps the device alive while its callback runs and balances the lookup on every successful path. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.") Signed-off-by: Ruoyu Wang Reviewed-by: Juergen Gross --- drivers/pci/xen-pcifront.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c index cffc32d6603277..07263dfe22d538 100644 --- a/drivers/pci/xen-pcifront.c +++ b/drivers/pci/xen-pcifront.c @@ -575,6 +575,7 @@ static pci_ers_result_t pcifront_common_process(int cmd, struct pcifront_device *pdev, pci_channel_state_t state) { + pci_ers_result_t result =3D PCI_ERS_RESULT_NONE; struct pci_driver *pdrv; int bus =3D pdev->sh_info->aer_op.bus; int devfn =3D pdev->sh_info->aer_op.devfn; @@ -597,21 +598,25 @@ static pci_ers_result_t pcifront_common_process(int c= md, pci_dbg(pcidev, "trying to call AER service\n"); switch (cmd) { case XEN_PCI_OP_aer_detected: - return pdrv->err_handler->error_detected(pcidev, state); + result =3D pdrv->err_handler->error_detected(pcidev, state); + break; case XEN_PCI_OP_aer_mmio: - return pdrv->err_handler->mmio_enabled(pcidev); + result =3D pdrv->err_handler->mmio_enabled(pcidev); + break; case XEN_PCI_OP_aer_slotreset: - return pdrv->err_handler->slot_reset(pcidev); + result =3D pdrv->err_handler->slot_reset(pcidev); + break; case XEN_PCI_OP_aer_resume: pdrv->err_handler->resume(pcidev); - return PCI_ERS_RESULT_NONE; + break; default: dev_err(&pdev->xdev->dev, "bad request in aer recovery operation!\n"); } } =20 - return PCI_ERS_RESULT_NONE; + pci_dev_put(pcidev); + return result; } =20 =20 --=20 2.51.0