From nobody Thu Sep 24 23:33:50 2026 Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 239B251AEDE for ; Fri, 18 Sep 2026 17:25:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789752304; cv=none; b=TOxwkc0cLBzkU4pNVy+bSNkYFaoC/we8EKqliJvN/yezIj4ziXILWdguyFZ+CTOz7Q91D9cToASrMFnXu6JwZYCrsb897jVKWHmHX9V/vARZuL/CEpfNxsk2PniLM4VZOdwsgQFZbJyJ3Fyxq97l0r1Gn6rx/4rKBLlTgqXzR0U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789752304; c=relaxed/simple; bh=nRfKlU0JdIMS7pIyYOtNbNNL4qpg+eZ3q8lelnV3/Dw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=gwR0S+s2Wa/W/s0zxEAZA9IwFExCzUtdJXA9dIIokCiqGLT7sJVZiux01Yc+Ez8KL3VgwavjPhJmp/ae+6vyC8e28unaSCnUrLZfaAJAzHycd/48Nvs2mpe8hFlrM5L+Xr4BhjjK8Rnfy8V5UH25bSdgWNRagQwlngd1sF12gCI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=sPZtFI9U; arc=none smtp.client-ip=209.85.216.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="sPZtFI9U" Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-39e3dad7ab3so1432250a91.2 for ; Fri, 18 Sep 2026 10:25:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1789752301; x=1790357101; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=72PNOxgvBxEa/OyDxE8+wmcHMjmCVv+wNt0o6l7GD3A=; b=sPZtFI9UvGlBuVl0YFIBiV3HSGFDTjN4k0jifAQJLlSSLvxHJ0crOFZqrSDA2kTt8B dqR5qdzoIaO7svteRzThvMEr/YUXqDMDiYbh1dIc2UICHX6FrQ8GzWd7CH/FQveFIrH9 CqazQnxkEQaWLIa/2Mr9n0PpqKg8XFoGFZe9YQVh6KTODbX4RhIA5p/KaUTWiVhlv+pe oP/Z1TQTSl6dqFQRPvrDCAV9wy+7BS0yhXfx0r9ufMieeiYTyPB379JYf62J+E5GGqFM UPKQhZgql1BVIMEo1cJcYIztN7pUP+feRFV/7lBZN86LDnvWPNqVhV0aInSGN8adBHcx k93Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789752301; x=1790357101; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=72PNOxgvBxEa/OyDxE8+wmcHMjmCVv+wNt0o6l7GD3A=; b=wetmZ3WJBsuLJ5a/j/5wbxxs9cZ5+kjQaDp4u2Wffi4KrEqJ3LRURDe1LInudVTt+P 3QhmMykzqiO9nYo9nVyIFI6BK1pBZD64LUX0uSSLB8GvTUad0nBAvq3tieFdEnwZRvyJ wAy9CRMhrS48pln6rW8clP+SRuZq12iHn1JpN05R33hadTPH2bgVUVZyPiNF+nTqFHCT ttNPBPxMwbdG7k+VmSmfFxFDEtnTrC2mNEw8fdraRHz74OR9BlnGXxJKrnPzoE2iJB2i W1wAaI9PViJEHYIDsVHhko3tJZkz+1JroTM0PnNIdAq+0cOLDMSuH72w2RhatQ3eHkZ3 WgQQ== X-Forwarded-Encrypted: i=1; AKwUvBygX4JsbAQzha/I9nQ4pL1ywJtGGNQZTzsBAN94pbUle1ULkKL0qswVnG3kwGnss+YTZk7ahl30Y52Anek=@vger.kernel.org X-Gm-Message-State: AFuF++mRxRCXWxgUvgu0+J32/miCzEI0kRxhG0CswlDww8Iu9qcbIiu3 t0LcDQapHmouUhyl6jhlN0aL+7jylvJ4kRWRo6Ipu18CmQxBW1nJNEnrud3ru9aTDrYZc/+79AP yNUtINxpE8WuJaP2CX7dfkOAzraDLVtbidw== X-Received: from pjue21.prod.google.com ([2002:a17:90a:e4d5:b0:39e:6e36:d13d]) (user=rathodpriyank job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90a:e7c9:b0:39d:f615:725e with SMTP id 98e67ed59e1d1-39e54bc3a8emr6915187a91.13.1789752300888; Fri, 18 Sep 2026 10:25:00 -0700 (PDT) Date: Fri, 18 Sep 2026 17:24:59 +0000 In-Reply-To: <20260918-b4-fix-aer-memleaks-v4-0-f0a2c21ed1d1@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260918-b4-fix-aer-memleaks-v4-0-f0a2c21ed1d1@google.com> X-Mailer: b4 0.14.3 Message-ID: <20260918-b4-fix-aer-memleaks-v4-1-f0a2c21ed1d1@google.com> Subject: [PATCH v4 1/2] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow From: Priyank Rathod To: Mahesh J Salgaonkar , "Oliver O'Halloran" , Bjorn Helgaas Cc: Lukas Wunner , linuxppc-dev@lists.ozlabs.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Priyank Rathod , stable@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When ACPI APEI/GHES processes PCIe AER error records, it allocates memory for aer_capability_regs (aer_regs) from ghes_estatus_pool and passes it to aer_recover_queue() to be enqueued into aer_recover_ring. If kfifo_in_spinlocked() fails due to a buffer overflow, aer_recover_queue() logged an error message but returned without freeing aer_regs. Because the entry was rejected and never inserted into the queue, aer_recover_work_func() could never dequeue or free it, leaking the allocated ghes_estatus_pool memory. aer_recover_queue() returns void, so the caller ghes_handle_aer() cannot free the buffer itself: ownership is transferred to the AER code, which until now only released it on the success path. Free aer_regs via ghes_estatus_pool_region_free() when kfifo_in_spinlocked() fails on buffer overflow. Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status= data has multiple sections") Cc: stable@vger.kernel.org Signed-off-by: Priyank Rathod --- drivers/pci/pcie/aer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c index d8dcd238fda1..b013b853b555 100644 --- a/drivers/pci/pcie/aer.c +++ b/drivers/pci/pcie/aer.c @@ -1415,11 +1415,14 @@ void aer_recover_queue(int domain, unsigned int bus= , unsigned int devfn, }; =20 if (kfifo_in_spinlocked(&aer_recover_ring, &entry, 1, - &aer_recover_ring_lock)) + &aer_recover_ring_lock)) { schedule_work(&aer_recover_work); - else + } else { pr_err("buffer overflow in recovery for %04x:%02x:%02x.%x\n", domain, bus, PCI_SLOT(devfn), PCI_FUNC(devfn)); + ghes_estatus_pool_region_free((unsigned long)aer_regs, + sizeof(struct aer_capability_regs)); + } } EXPORT_SYMBOL_GPL(aer_recover_queue); #endif --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Thu Sep 24 23:33:50 2026 Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C99C51A13F for ; Fri, 18 Sep 2026 17:25:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.70 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789752306; cv=none; b=guoVLYpOfZ1LbhAU97f+0RipRpv2zw9su464c+fJrZdPBHT0xzwoX+1qMjqiVH6FfBaFdxsECHMHsb+eCKS7L/NYZY54iD1MjjcJstH/mTGLCc4/+dcUH50uGGKURbUKYfT7MP/vgA+EqMCuS+wwEYYhcfqC+c1xlx4i8SyhMAg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789752306; c=relaxed/simple; bh=gyzu7hiJ3Qnl1lJv3yLmoKcTJ7DYT/6eEZnrdziKtHA=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=gERho+CAsh/WeblTpYzH1gN0PatXnw5YNZHAs0at7T+G+llcoDskLFHBzOi9tww3g11PR6uU3w2xNDROQ7axYrjywxJuser+4bulIvmPhKL0vlAUYeP92Db6rrA7NFvfVtYUu2G4RWNGIy5c/h4KjVrMxIokv0zygeW3MzgFp8A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Pq/mvND6; arc=none smtp.client-ip=209.85.216.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Pq/mvND6" Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-39b77130a7fso1898999a91.2 for ; Fri, 18 Sep 2026 10:25:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1789752302; x=1790357102; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2+kfPgEY96uE/H1ipyuvALA/uo1X/ydteu6QiwY353A=; b=Pq/mvND6DlrflQpBcuNad5p/op3caMU9JmIRjYQ9tqkQNQM7bBZc31WxZb47zo6c8c /RjvGU7UObK/LC2bF6sAigCAcrpeuYTaBcGU6+PwCZQJ5MJKdj6PClf0pUB+yOeF0FWH +T4uFHigBlKQJIVa3wUqUi7K7NfccEN15qDiSk0g0e3GROoxrpQo8N/TarEiCpFHm71V 2kIaLCbEm762C5s71BB+2xJfj0A2fSJPm9lsccbWZchFk4UoJxE/+axNy6TPO9ac1PPN 7LCQW2pd7/sxtlSvYEPCdJqKpTcWyScLnpHux3fE94RosSd8Of5kGhT+qfmHAFnnc3Z6 nkkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789752302; x=1790357102; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2+kfPgEY96uE/H1ipyuvALA/uo1X/ydteu6QiwY353A=; b=h1ltc5mx5kwpI21a9S1xJILF6oKBME98wUoQnLDlPjfqB9inh+JSxWJtKdhiqNhAS+ u+BixAKgw/ezWvhUaugPVAIQApygEohrk58rq7QXCIsXQE8jaTXWOYW+UvO4UCJu7nvw z5SNLMwrfUzwSbkDzP33aEZn2/lIDmDykM/80I0smsBtYtdgjQVfF5zZJ4XrrxXFPCyR 0Udu8GV6yhqLQpPpXyGFGfj9Mvzm30AJLjY8PnD+jwcojuvkh0EZMcIzC3ibiq3IIgTH G+Kbqf4e+d2iirtLk1k6fC9/Jv/oFVWFKU30PCSTZMb3lmDivKFHSucrMTfQKtz3ceAH B6fQ== X-Forwarded-Encrypted: i=1; AKwUvByg7EReZ3oyUQf8U6YXKKCKkHZxZiNdSW7Ot8vAQ04+oFXvdoGOpum0gQbOGTtyJTfY+jbxMz1i2c47TpY=@vger.kernel.org X-Gm-Message-State: AFuF++m/2ahELgmBYxXXsiOoMAI8ajbcIFCQTpnqZn5xMssD22kQ21+7 mzJgJtwl0Ll8OFh3VmLpunsfzepW5usC3FNvcwKkz3r3iuqfUoHLAabvItWJ2CKjMEgUUG2vXHW /lzaGSglGbXB1UjWADcKjci+10TZx7zLvCw== X-Received: from pjbin15.prod.google.com ([2002:a17:90b:438f:b0:39e:5e7e:fbe7]) (user=rathodpriyank job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90a:3f08:b0:39e:6a81:5a98 with SMTP id 98e67ed59e1d1-39e6a815e38mr670166a91.44.1789752301759; Fri, 18 Sep 2026 10:25:01 -0700 (PDT) Date: Fri, 18 Sep 2026 17:25:00 +0000 In-Reply-To: <20260918-b4-fix-aer-memleaks-v4-0-f0a2c21ed1d1@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260918-b4-fix-aer-memleaks-v4-0-f0a2c21ed1d1@google.com> X-Mailer: b4 0.14.3 Message-ID: <20260918-b4-fix-aer-memleaks-v4-2-f0a2c21ed1d1@google.com> Subject: [PATCH v4 2/2] PCI/AER: Fix memory leak in aer_recover_work_func() when pci_dev is missing From: Priyank Rathod To: Mahesh J Salgaonkar , "Oliver O'Halloran" , Bjorn Helgaas Cc: Lukas Wunner , linuxppc-dev@lists.ozlabs.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Priyank Rathod , stable@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When ACPI APEI/GHES processes PCIe AER error records, it allocates memory for aer_capability_regs (entry.regs) from ghes_estatus_pool and queues the entry into aer_recover_ring. In aer_recover_work_func(), items are popped from aer_recover_ring via kfifo_get(). If pci_get_domain_bus_and_slot() fails to find a matching pci_dev, the code previously executed 'continue', bypassing the call to ghes_estatus_pool_region_free(). As a result, the memory allocated for entry.regs from ghes_estatus_pool was leaked. This is reachable whenever the device reported by firmware is not (or is no longer) present in the PCI device tree, e.g. after hot-removal or when firmware reports an error for a device the kernel never enumerated. Refactor aer_recover_work_func() to ensure ghes_estatus_pool_region_free() is called unconditionally for every dequeued entry, releasing the pool memory even when pci_dev is missing. Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status= data has multiple sections") Cc: stable@vger.kernel.org Signed-off-by: Priyank Rathod --- drivers/pci/pcie/aer.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c index b013b853b555..a6600801af6e 100644 --- a/drivers/pci/pcie/aer.c +++ b/drivers/pci/pcie/aer.c @@ -1366,14 +1366,13 @@ static void aer_recover_work_func(struct work_struc= t *work) while (kfifo_get(&aer_recover_ring, &entry)) { pdev =3D pci_get_domain_bus_and_slot(entry.domain, entry.bus, entry.devfn); - if (!pdev) { + if (!pdev) pr_err_ratelimited("%04x:%02x:%02x.%x: no pci_dev found\n", entry.domain, entry.bus, PCI_SLOT(entry.devfn), PCI_FUNC(entry.devfn)); - continue; - } - pci_print_aer(pdev, entry.severity, entry.regs); + else + pci_print_aer(pdev, entry.severity, entry.regs); =20 /* * Memory for aer_capability_regs(entry.regs) is being @@ -1385,13 +1384,15 @@ static void aer_recover_work_func(struct work_struc= t *work) ghes_estatus_pool_region_free((unsigned long)entry.regs, sizeof(struct aer_capability_regs)); =20 - if (entry.severity =3D=3D AER_NONFATAL) - pcie_do_recovery(pdev, pci_channel_io_normal, - aer_root_reset); - else if (entry.severity =3D=3D AER_FATAL) - pcie_do_recovery(pdev, pci_channel_io_frozen, - aer_root_reset); - pci_dev_put(pdev); + if (pdev) { + if (entry.severity =3D=3D AER_NONFATAL) + pcie_do_recovery(pdev, pci_channel_io_normal, + aer_root_reset); + else if (entry.severity =3D=3D AER_FATAL) + pcie_do_recovery(pdev, pci_channel_io_frozen, + aer_root_reset); + pci_dev_put(pdev); + } } } =20 --=20 2.55.0.1082.g2b9226bbc0-goog