From nobody Fri Aug 14 15:50:34 2026 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51FF241A797 for ; Fri, 14 Aug 2026 13:39:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714787; cv=none; b=IVLRZKG7wDVF3mRHoGBSD7pl5luQCj5qUBLAut/gY0RyWPIzem8QIF2hf4Biw4gWdF/rlhd+/xxqdk8HpFEWoRTkGHFnOjJV5uUyB1TeiY+XXcQO0Tyqmb5XrYwd0ZqOFdImFIxtFJ/C5vN8ut3gNwN0Ds7br8cNDrPOZeFEZY8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714787; c=relaxed/simple; bh=M4T/XKvyLQRe89mGAnILG1wCu5GQjz+m+aaDNSsMXLE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sl+i4LxHpi+fDko3IKdZ7Zwc/UEV8kwEVcZYaJEngdxcwMaPXEbqFOa8VVyqCyB12BD713CASCmPYwkBU8vkaqKfMuQFsSbojVLS1X/jFc8QFp0lugSsqSNDK1cIQKuJNqS8HIsIsvXkRa9oVSmWmWGuih3LKm0vYtHq/2d4Rb4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=My1GwzgC; arc=none smtp.client-ip=209.85.215.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="My1GwzgC" Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-c96c92c0980so570129a12.3 for ; Fri, 14 Aug 2026 06:39:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786714785; x=1787319585; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=4kO0JaiBBnnltUiqSOwY9zKyhYcIekp3YnHUYrb9Wic=; b=My1GwzgCnld7ZR4f02O6MfTSSHjfdy080L3K3zxJnS9nCnqP8LcW0Lhg9gDus6cgAy hjmP5f/pfQ58an9p08+XLkTrL6UihClpDAKWqRVkEFnesbF5qYeAwIkHaaYImaUMYr2k lOefz4QQAbgyR1qt4pQGNpmDjVTHNC6R81ZM2U/XpW4j/kPcpYbRkZh1Wh9W0uDAS0Pl Jso7E8DQEGNiyuF5MmgXoVeF23EONZFw4eb8sMYZlonP7lbbAHCkCdA0+8BWDW9InWjw SIZFxp8q5q1dQhdBfjyVOyeR5Jtn7OtvZv3D1qJKOXH20XuSBKYx6KlEjhelG0c7lkaw gorQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786714785; x=1787319585; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4kO0JaiBBnnltUiqSOwY9zKyhYcIekp3YnHUYrb9Wic=; b=CGUiQgTBekJW7KexltnXnRZotDjZ5OGqrMRQRNKgYHFy5fZFvzisi4mnLopBCd6xem 3ymS+YuuBDunoPgPCQHA1n3+q3eFzgA8E4XIdt3Uv5jQ0ye/RfG9hOXO2i0R3z8puRON Do1njAG+wdCK3Jh/vdF7nxukIlmgqlMm06LXw9IZgPTigjs9Lvr52u2gK3tlrG5z7Gty CAAD+ggeWojapU3NN8p8wjSh8ZfxqxkqklF4Rm3PxFFT0O5+w9hAG8hF1hVGk7LUtJNQ 7LsEhmGfq7PAFfAIJjRkVj8CLuMxPJJsZBzpYaNgaPp4cwWLPEITXveMvwFmqX9v6JzH jn0w== X-Forwarded-Encrypted: i=1; AHgh+RoHXHW35n2vuoo5uWv/NcTaVIfvKviucFnFMou92EV6acUmOJWaVVxIq9/WfGwO91YKFNTfgBuhOZUr0Jc=@vger.kernel.org X-Gm-Message-State: AOJu0YxkAup6qwG3qMiSQbK6Qh783IRAqtQcuzjDY432ADRqFOcKQ8TT YkMYgfAd+W1ZBe+S1Ip5b7BHChpdGEOEiVHmbecAtPIAa8JfX2x5hPG/ X-Gm-Gg: AR+sD13Tmx6/VTERvTxFIbW5fnGtALyVkdjVZkZ5XBe3U1VCyAv27T0IXTJJuLQtJME PEz4cGs5ha9Es9QPoNY5GPopnGtnsthqlvu9+oqpHSf56kV9cdhNQCgrs1P2Cp9pXjtAlkDj8Vc JcCWjP5i1jeEecRynUYR/nt1HenqQPsGhROPVN+Odwy2a/gOPTjfFAkiRdl4tZU6P27DkptSgnz gyGcqstEcjRcWKX5ecLC0BsKgkGS9q77UaexrPR0PYtAbjGyfQpGFnMwV1kIFQD3BOLy8VCMtVL gc1Gp2iC7yxFZYze8EcbLwteZSV7MfGWuRCUFOVTEP6voC9KXNFcVa2LTOwvq8DECv0uTXTPBZf 1fm2UU5jyMlNg1VxPMZY5mqwfhDbdnlf8fqJVVXJ5bm+PL84pB8YWNwIghYZEqgb1tBZT59mBTG zcd38IuAjmXtUjchadlCPeHG4LdQV4CLI2XmdxGPPUsTIlmNjqSucFI0GOf8gk6aZbye/I9UB+5 eHcATKr X-Received: by 2002:a05:6a20:160e:b0:3b4:5ff3:45cb with SMTP id adf61e73a8af0-3cc719ff645mr7300940637.8.1786714785389; Fri, 14 Aug 2026 06:39:45 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:e9af:7c0e:be31:2c3f]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc095a4c7a4sm591739a12.31.2026.08.14.06.39.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 06:39:45 -0700 (PDT) From: Ruoyu Wang To: Joerg Roedel , Suravee Suthikulpanit , Will Deacon , Robin Murphy , Jason Gunthorpe , Wei Huang , Vasant Hegde Cc: iommu@lists.linux.dev, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] iommu/amd: Fix PCI device reference leak in PPR handling Date: Fri, 14 Aug 2026 21:39:38 +0800 Message-ID: <20260814133938.1385879-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" pci_get_domain_bus_and_slot() takes a reference on the returned PCI device. iommu_call_iopf_notifier() fails to release it after either reporting a valid PPR fault or completing a rejected request. Each handled request therefore leaks a reference and can prevent the PCI device from being released. Call pci_dev_put() after the final use of the lookup reference on both paths. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler") Signed-off-by: Ruoyu Wang --- drivers/iommu/amd/ppr.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c index 1f8d2823bea42..1e4392b17bd8f 100644 --- a/drivers/iommu/amd/ppr.c +++ b/drivers/iommu/amd/ppr.c @@ -151,6 +151,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *= iommu, u64 *raw) =20 /* Submit event */ iommu_report_device_fault(&pdev->dev, &event); + pci_dev_put(pdev); =20 return; =20 @@ -159,6 +160,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *= iommu, u64 *raw) amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]), IOMMU_PAGE_RESP_FAILURE, PPR_TAG(raw[0]) & 0x1FF); + pci_dev_put(pdev); } =20 void amd_iommu_poll_ppr_log(struct amd_iommu *iommu) --=20 2.51.0