pcistub_get_gsi_from_sbdf() obtains the stub device with
pcistub_device_find(), which returns it with its kref incremented, and
returns psdev->gsi without dropping that reference again.  The caller
cannot release it either, so every lookup leaks one reference to the
stub device.

Release the reference after reading gsi.

Fixes: 2fae6bb7be32 ("xen/privcmd: Add new syscall to get gsi from dev")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/xen/xen-pciback/pci_stub.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 79a2b5dfd694..d1a335233aab 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -234,13 +234,16 @@ static int pcistub_get_gsi_from_sbdf(unsigned int sbdf)
 	int bus = PCI_BUS_NUM(sbdf);
 	int slot = PCI_SLOT(sbdf);
 	int func = PCI_FUNC(sbdf);
+	int gsi;
 
 	psdev = pcistub_device_find(domain, bus, slot, func);
-
 	if (!psdev)
 		return -ENODEV;
 
-	return psdev->gsi;
+	gsi = psdev->gsi;
+	pcistub_device_put(psdev);
+
+	return gsi;
 }
 #endif
 
-- 
2.34.1

On 9/17/26 01:11, Wentao Liang wrote:
> pcistub_get_gsi_from_sbdf() obtains the stub device with
> pcistub_device_find(), which returns it with its kref incremented, and
> returns psdev->gsi without dropping that reference again.  The caller
> cannot release it either, so every lookup leaks one reference to the
> stub device.
> 
> Release the reference after reading gsi.
> 
> Fixes: 2fae6bb7be32 ("xen/privcmd: Add new syscall to get gsi from dev")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Thanks.
Reviewed-by: Jiqian Chen <Jiqian.Chen@amd.com>

> ---
>  drivers/xen/xen-pciback/pci_stub.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
> index 79a2b5dfd694..d1a335233aab 100644
> --- a/drivers/xen/xen-pciback/pci_stub.c
> +++ b/drivers/xen/xen-pciback/pci_stub.c
> @@ -234,13 +234,16 @@ static int pcistub_get_gsi_from_sbdf(unsigned int sbdf)
>  	int bus = PCI_BUS_NUM(sbdf);
>  	int slot = PCI_SLOT(sbdf);
>  	int func = PCI_FUNC(sbdf);
> +	int gsi;
>  
>  	psdev = pcistub_device_find(domain, bus, slot, func);
> -
>  	if (!psdev)
>  		return -ENODEV;
>  
> -	return psdev->gsi;
> +	gsi = psdev->gsi;
> +	pcistub_device_put(psdev);
> +
> +	return gsi;
>  }
>  #endif
>  

-- 
Best regards,
Jiqian Chen.