xen_pcibk_export_device() takes a pcistub_device reference through
pcistub_get_pci_dev_by_slot().  On success xen_pcibk_add_pci_dev()
stores the device on the backend's device list and the reference is
released later by xen_pcibk_release_devices().

When the add fails before the device was queued -- the list entry
allocation fails, or for the vpci backend the device is a bridge or no
virtual slot is free -- the reference is never dropped.  psdev->pdev
then keeps pointing at the pdev that free_pdev() frees, and the device
can never be exported to a guest again because
pcistub_device_get_pci_dev() rejects a psdev that already has an owner.

Drop the reference on these paths, taking the device lock which
pcistub_put_pci_dev() requires.  Whether the device was queued is
checked with the coordinates the frontend sees, obtained through
xen_pcibk_get_pcifront_dev(), because the vpci backend hides the real
topology behind a single virtual bus.  The reference is kept when the
failure came from the publish callback, which runs after
list_add_tail() and is undone by xen_pcibk_release_devices().

Fixes: 30edc14bf39a ("xen/pciback: xen pci backend driver.")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/xen/xen-pciback/xenbus.c | 33 +++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c
index b34785ba72e1..07e89d4593bb 100644
--- a/drivers/xen/xen-pciback/xenbus.c
+++ b/drivers/xen/xen-pciback/xenbus.c
@@ -223,6 +223,22 @@ static int xen_pcibk_publish_pci_dev(struct xen_pcibk_device *pdev,
 	return err;
 }
 
+/* Is @dev on the device list of the backend behind @pdev? */
+static bool xen_pcibk_dev_is_exported(struct xen_pcibk_device *pdev,
+				      struct pci_dev *dev)
+{
+	unsigned int domain, bus, devfn;
+
+	/*
+	 * The lists are keyed on the coordinates the frontend sees, which
+	 * xen_pcibk_get_pcifront_dev() reports for @dev.
+	 */
+	if (!xen_pcibk_get_pcifront_dev(dev, pdev, &domain, &bus, &devfn))
+		return false;
+
+	return xen_pcibk_get_pci_dev(pdev, domain, bus, devfn) == dev;
+}
+
 static int xen_pcibk_export_device(struct xen_pcibk_device *pdev,
 				 int domain, int bus, int slot, int func,
 				 int devid)
@@ -246,8 +262,23 @@ static int xen_pcibk_export_device(struct xen_pcibk_device *pdev,
 
 	err = xen_pcibk_add_pci_dev(pdev, dev, devid,
 				    xen_pcibk_publish_pci_dev);
-	if (err)
+	if (err) {
+		/*
+		 * The reference taken above is only handed over once the
+		 * device is queued on the backend's device list.  Failures
+		 * before that (no entry, bridge on the vpci bus, no free
+		 * virtual slot) have to drop it here, otherwise the device
+		 * stays pinned to a pdev that is about to be freed.  A
+		 * failing publish callback comes after the queueing and is
+		 * undone by xen_pcibk_release_devices().
+		 */
+		if (!xen_pcibk_dev_is_exported(pdev, dev)) {
+			device_lock(&dev->dev);
+			pcistub_put_pci_dev(dev);
+			device_unlock(&dev->dev);
+		}
 		goto out;
+	}
 
 	dev_info(&dev->dev, "registering for %d\n", pdev->xdev->otherend_id);
 	if (xen_register_device_domain_owner(dev,
-- 
2.34.1

On Wed, 04 Nov 2026 02:15:37 +0000, Wentao Liang wrote:
> xen_pcibk_export_device() takes a pcistub_device reference through
> pcistub_get_pci_dev_by_slot().  On success xen_pcibk_add_pci_dev()
> stores the device on the backend's device list and the reference is
> released later by xen_pcibk_release_devices().
> 
> When the add fails before the device was queued -- the list entry
> allocation fails, or for the vpci backend the device is a bridge or no
> virtual slot is free -- the reference is never dropped.  psdev->pdev
> then keeps pointing at the pdev that free_pdev() frees, and the device
> can never be exported to a guest again because
> pcistub_device_get_pci_dev() rejects a psdev that already has an owner.
> 
> Drop the reference on these paths, taking the device lock which
> pcistub_put_pci_dev() requires.  Whether the device was queued is
> checked with the coordinates the frontend sees, obtained through
> xen_pcibk_get_pcifront_dev(), because the vpci backend hides the real
> topology behind a single virtual bus.  The reference is kept when the
> failure came from the publish callback, which runs after
> list_add_tail() and is undone by xen_pcibk_release_devices().
> 
> Fixes: 30edc14bf39a ("xen/pciback: xen pci backend driver.")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/xen/xen-pciback/xenbus.c | 33 +++++++++++++++++++++++++++++++-
>  1 file changed, 32 insertions(+), 1 deletion(-)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof