pci_get_domain_bus_and_slot() returns a PCI device with an elevated
reference count, but iommu_call_iopf_notifier() never drops it, neither
when the page request has been reported nor on the abort path.
Put the device reference on both exits.
Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/iommu/amd/ppr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c
index 1f8d2823bea4..1e4392b17bd8 100644
--- a/drivers/iommu/amd/ppr.c
+++ b/drivers/iommu/amd/ppr.c
@@ -151,6 +151,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
/* Submit event */
iommu_report_device_fault(&pdev->dev, &event);
+ pci_dev_put(pdev);
return;
@@ -159,6 +160,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]),
IOMMU_PAGE_RESP_FAILURE,
PPR_TAG(raw[0]) & 0x1FF);
+ pci_dev_put(pdev);
}
void amd_iommu_poll_ppr_log(struct amd_iommu *iommu)
--
2.34.1