pci_get_domain_bus_and_slot() takes a reference on the returned PCI
device. iommu_call_iopf_notifier() fails to release it after either
reporting a valid PPR fault or completing a rejected request. Each
handled request therefore leaks a reference and can prevent the PCI
device from being released.

Call pci_dev_put() after the final use of the lookup reference on both
paths.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/iommu/amd/ppr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c
index 1f8d2823bea42..1e4392b17bd8f 100644
--- a/drivers/iommu/amd/ppr.c
+++ b/drivers/iommu/amd/ppr.c
@@ -151,6 +151,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
 
 	/* Submit event */
 	iommu_report_device_fault(&pdev->dev, &event);
+	pci_dev_put(pdev);
 
 	return;
 
@@ -159,6 +160,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
 	amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]),
 			       IOMMU_PAGE_RESP_FAILURE,
 			       PPR_TAG(raw[0]) & 0x1FF);
+	pci_dev_put(pdev);
 }
 
 void amd_iommu_poll_ppr_log(struct amd_iommu *iommu)
-- 
2.51.0