From nobody Fri Oct 2 07:47:18 2026 Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6094E4DDB4F for ; Mon, 28 Sep 2026 17:40:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790617235; cv=none; b=Bt9V8YGy4NyL3oKp9Ty06b3d/hbh4gMktJVLxk1WdKRI3ZOCuEvTI5/2Y7d84PtHwgGeie7DMPUpGaFTIrSsl4qDJvak2Pm4wmmFj8fcpuXk/WiD9Mbri1UGhBN4W1SRAmqRe1pZ8kiPpS3D804vxwwWcRzCl/tTBoBZ2x8ssFc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790617235; c=relaxed/simple; bh=bhpyAU15yC6QPGadz4JxsbfOGUa1ye2WK8iafRoSRFc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Gv2dJK7D0JtOum04yUXd79oVpHwdDc2tjcBcqLsh61Z9Ozm4iHS5LmqiGrAbFhAk+ua3NNiZjz8WykCN73cxfs64hUaTIhNZHsayQHaAnI9TrHDFe4DeWVmJiovICfwCNUAXBiat99531R5d6Dhhdom16DKBZnnR+e8wCLgEgEc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=oFFw/qtm; arc=none smtp.client-ip=209.85.216.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="oFFw/qtm" Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-3a470ead068so882015a91.3 for ; Mon, 28 Sep 2026 10:40:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790617234; x=1791222034; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=sw50tyOgJDy5SizTNDQpXrNC0JD8AqhCQeUwJLrCoro=; b=oFFw/qtmkPcaAdDhrUT5O3OKP1pPiLdlkXUnQWEkCnpfSnvmQ4mKhOQTryU1BlQYUh WvSCFj5VZVY6FQr7ftU2w4p9LC2JMiew04+IT97ZsM+M8Ab0ESNZ+vbgdDbvgBQS6JnV S9djDEag7sU7dmZD14OmkRvzAlgtWNepeV7HjC3sAZGJLCzRjD2Mq544g1HvQT/oVIGO i/2M9RBU8xL03m8QLIhxQ2juNBWO75WGenLWGMPOy1ZrGrOJzFZGyWz1juvnoMq7o7yo xGOAsnVMheqlCu8Tuf/NQ59bBfeSGVqSzBSzT3Ef97qPTzMKQrWJPdu/OIkvhg1OF4Cd PYsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790617234; x=1791222034; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=sw50tyOgJDy5SizTNDQpXrNC0JD8AqhCQeUwJLrCoro=; b=OXZvpZAZBWa0JI0xEXWyCtgIEpwmKCrGPYhV3X+f5Yn4k3zhNwR+NTR/ytylKdgaG9 pQ8eE074NhgPJHX0Pq6N788Xm9r4h4k8aX0mXhqQC3/333K9WM08txe/yGzOkVtikueu 3lQ+yiPfFNPlpf/zmL0jB7jKUPShA59T2/B4Y3ZR3Tfety3Ud+21P8ZiZBQ/fcivjj90 ApAK6nJmY6JX1OT7p9pGEv3YNf8sf1TrKwrunFpQRVRUGk7xh/kohz2w2MJaWW77WhJ2 4rdf6f62wxkPVWDsuwzQWeJzCbMo6f/8YaqV9Jhw9+m2SBYHYqXE/netNPz2VKWLkC0X PfEw== X-Forwarded-Encrypted: i=1; AKwUvBwXLC++rEsCP5Y9oZx4ZzOh/WvXV+kci7IigdhAv2LaY0+v/jasSioEeKBO7Y8kFm9abs+0HH0Ye9szKZU=@vger.kernel.org X-Gm-Message-State: AFq9FYKsEMe97H/k6TFdmATL6hSCz4GqRQarsw6lc2KZdnuH3lUL0apj URLkK9CP/Cebr0xk6Crc6CY/bnK8rQ8SUzhaxzdQskNYZO5Q7vq8+53I1qIoezKryHPXDg5u5Ca 2ojb55xrwSxUjiagw1NC72FUzs73U2F5iNg== X-Received: from pjyo13.prod.google.com ([2002:a17:90a:eb8d:b0:3a0:dfb1:6c07]) (user=rathodpriyank job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:3a46:b0:3a2:b04e:8086 with SMTP id 98e67ed59e1d1-3a2b04e8389mr2449084a91.44.1790617233471; Mon, 28 Sep 2026 10:40:33 -0700 (PDT) Date: Mon, 28 Sep 2026 17:40:12 +0000 In-Reply-To: <20260928-b4-fix-aer-memleaks-v5-0-ba6b94c9c9a6@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260928-b4-fix-aer-memleaks-v5-0-ba6b94c9c9a6@google.com> X-Mailer: b4 0.14.3 Message-ID: <20260928-b4-fix-aer-memleaks-v5-1-ba6b94c9c9a6@google.com> Subject: [PATCH v5 1/3] PCI/AER: Fix memory leak in aer_recover_queue() on kfifo buffer overflow From: Priyank Rathod To: Mahesh J Salgaonkar , "Oliver O'Halloran" , Bjorn Helgaas Cc: Lukas Wunner , Kuppuswamy Sathyanarayanan , Jonathan Cameron , "=?utf-8?q?Ilpo_J=C3=A4rvinen?=" , Dave Jiang , Shiju Jose , "Rafael J. Wysocki" , linuxppc-dev@lists.ozlabs.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Priyank Rathod , stable@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When ACPI APEI/GHES processes PCIe AER error records, it allocates memory for aer_capability_regs (aer_regs) from ghes_estatus_pool and passes it to aer_recover_queue() to be enqueued into aer_recover_ring. If kfifo_in_spinlocked() fails due to a buffer overflow, aer_recover_queue() logged an error message but returned without freeing aer_regs. Because the entry was rejected and never inserted into the queue, aer_recover_work_func() could never dequeue or free it, leaking the allocated ghes_estatus_pool memory. aer_recover_queue() returns void, so the caller ghes_handle_aer() cannot free the buffer itself: ownership is transferred to the AER code, which until now only released it on the success path. Free aer_regs via ghes_estatus_pool_region_free() when kfifo_in_spinlocked() fails on buffer overflow. Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status= data has multiple sections") Cc: stable@vger.kernel.org Reviewed-by: Kuppuswamy Sathyanarayanan Signed-off-by: Priyank Rathod --- drivers/pci/pcie/aer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c index d8dcd238fda1..b013b853b555 100644 --- a/drivers/pci/pcie/aer.c +++ b/drivers/pci/pcie/aer.c @@ -1415,11 +1415,14 @@ void aer_recover_queue(int domain, unsigned int bus= , unsigned int devfn, }; =20 if (kfifo_in_spinlocked(&aer_recover_ring, &entry, 1, - &aer_recover_ring_lock)) + &aer_recover_ring_lock)) { schedule_work(&aer_recover_work); - else + } else { pr_err("buffer overflow in recovery for %04x:%02x:%02x.%x\n", domain, bus, PCI_SLOT(devfn), PCI_FUNC(devfn)); + ghes_estatus_pool_region_free((unsigned long)aer_regs, + sizeof(struct aer_capability_regs)); + } } EXPORT_SYMBOL_GPL(aer_recover_queue); #endif --=20 2.56.0.rc1.315.gc6ed9934b7-goog From nobody Fri Oct 2 07:47:18 2026 Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4FFF834887B for ; Mon, 28 Sep 2026 17:40:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790617236; cv=none; b=K5iAznykloNVaPm7ADhK0xXM8TjrprHJBg3B5utDuSUc/2pqoWCF7/P2ztA7U9qiZhIjVuucjDkR2yrtX4T2co6QERGfl4tZw5wGZsRZqcVRR8u6uNKMeJPyseVT4oqILL0NWqMsMLHj5l+dTKo1zK1a8KPeNwP6Oi+udczHWc0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790617236; c=relaxed/simple; bh=egCjPYrpj0utXu6SkvCs7DAxmpJxg6GIRoCVZ1sislQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=JOErrjS3uO7uRdVwxmpjl2Lx52/aiHukf2lZHlLWQP5XYwPKWbdPvL9aM+y/quyCZlFcaE5IQ8zCCK6+EVyem7PEtLZAirJ0K0/VauXf2DKumMXorY0fDbYjpHUpGnQlbjX3BbroMBm8VS6QeHYiPwV7ehvhlqU/vKazO2xRf/w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=m/+wC2Re; arc=none smtp.client-ip=209.85.216.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="m/+wC2Re" Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-38e8fee6af3so3193360a91.1 for ; Mon, 28 Sep 2026 10:40:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790617235; x=1791222035; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=cnJQd6bdeFsZrWHaIElFpdpCIChAmHD+YCH6lWp5XiY=; b=m/+wC2RezAeb4p4jDP4rF2BiWSUVjdySFvM4/G+EcPVaX00Zpx41X/uP/eqUs9lPHd skq+DD0plJCIXhL0ZLGogiXcyJDOzQt83wc9nPTc5zT57zDHEswv8VPGcwGGKlInR3Ii yJhVGmYZ8WjzDVx1Zv063M7hEQCatrF5mVv8NLKhadp1kmFWeRC+oIiwogqYxXtPGMUj ZRqAxLXHpJUe+91WAGfDwIROYIPmenEeQYAle9vYtvacXcgGhXxsVkRWp97zt76l/w2W Qi+jVhl+Kz2J0OiS5wz644b7WgsUCLOMAMHATyKUaL4fkdM+MIQ9o1DnVCTHh3wEJT7+ jF2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790617235; x=1791222035; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=cnJQd6bdeFsZrWHaIElFpdpCIChAmHD+YCH6lWp5XiY=; b=k6Rt0/2sNMkMlncwX7/aXIt89qev+xOimeF+Giwp55k5N92yzIvYQ2f1EDidYsZYmB YAAwdFU93zq+aA0Q3Py4WYxSg2qPze7IQBhVwMEWIFAodwgrXsaLB2pS3jNs+rGYkRVS xSygjyRZcpGsLSIrNNEXu5+jbvL2Qwwfg8Fo0HdyJtgun5slupZTZv7PwpjMx/5oPaRs 4qsfjUcK4C8NAQRQsEfUbp2P6Tl9of/REDfPV8xI+06K5tvGtJNPripPCFuKYPdO1lD4 V3yG0XzdNsNNB40qGCiikshJ0O5fYExhEknFVNnrD8JaIwFaF5bkGlZOJiSjZ9NBwN9I 1dSA== X-Forwarded-Encrypted: i=1; AKwUvBzdymDxNA4idM9FTEpnhmQyg6GTPrcmJ4QWa0gc+xqkc83eb0SN93/h/2Gg7l/P+nFk1DFFippuh8h4ppo=@vger.kernel.org X-Gm-Message-State: AFq9FYJWalBJKH/3COCZHXk2kMsQu9vB65/7x3FcRKL8BFq/9NvcobAY DyDSyIMXFyoiC2NqeWVt/MtXyOghSJQhYWAy0tkvkqYtG7iVBjADr92Zo7yS2JWqT88GJbQhOpr O1FEpcGimMiGOfFeoWuXLgAhqUKORztbCrA== X-Received: from pgav19.prod.google.com ([2002:a05:6a02:2dd3:b0:cc7:ab3a:23c7]) (user=rathodpriyank job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:498c:b0:3a0:903b:f253 with SMTP id 98e67ed59e1d1-3a09875d77cmr11025914a91.18.1790617234359; Mon, 28 Sep 2026 10:40:34 -0700 (PDT) Date: Mon, 28 Sep 2026 17:40:13 +0000 In-Reply-To: <20260928-b4-fix-aer-memleaks-v5-0-ba6b94c9c9a6@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260928-b4-fix-aer-memleaks-v5-0-ba6b94c9c9a6@google.com> X-Mailer: b4 0.14.3 Message-ID: <20260928-b4-fix-aer-memleaks-v5-2-ba6b94c9c9a6@google.com> Subject: [PATCH v5 2/3] PCI/AER: Fix memory leak in aer_recover_work_func() when pci_dev is missing From: Priyank Rathod To: Mahesh J Salgaonkar , "Oliver O'Halloran" , Bjorn Helgaas Cc: Lukas Wunner , Kuppuswamy Sathyanarayanan , Jonathan Cameron , "=?utf-8?q?Ilpo_J=C3=A4rvinen?=" , Dave Jiang , Shiju Jose , "Rafael J. Wysocki" , linuxppc-dev@lists.ozlabs.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Priyank Rathod , stable@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When ACPI APEI/GHES processes PCIe AER error records, it allocates memory for aer_capability_regs (entry.regs) from ghes_estatus_pool and queues the entry into aer_recover_ring. In aer_recover_work_func(), items are popped from aer_recover_ring via kfifo_get(). If pci_get_domain_bus_and_slot() fails to find a matching pci_dev, the code previously executed 'continue', bypassing the call to ghes_estatus_pool_region_free(). As a result, the memory allocated for entry.regs from ghes_estatus_pool was leaked. This is reachable whenever the device reported by firmware is not (or is no longer) present in the PCI device tree, e.g. after hot-removal or when firmware reports an error for a device the kernel never enumerated. Refactor aer_recover_work_func() to ensure ghes_estatus_pool_region_free() is called unconditionally for every dequeued entry, releasing the pool memory even when pci_dev is missing. Fixes: e2abc47a5a1a ("ACPI: APEI: Fix AER info corruption when error status= data has multiple sections") Cc: stable@vger.kernel.org Reviewed-by: Kuppuswamy Sathyanarayanan Signed-off-by: Priyank Rathod --- drivers/pci/pcie/aer.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c index b013b853b555..a6600801af6e 100644 --- a/drivers/pci/pcie/aer.c +++ b/drivers/pci/pcie/aer.c @@ -1366,14 +1366,13 @@ static void aer_recover_work_func(struct work_struc= t *work) while (kfifo_get(&aer_recover_ring, &entry)) { pdev =3D pci_get_domain_bus_and_slot(entry.domain, entry.bus, entry.devfn); - if (!pdev) { + if (!pdev) pr_err_ratelimited("%04x:%02x:%02x.%x: no pci_dev found\n", entry.domain, entry.bus, PCI_SLOT(entry.devfn), PCI_FUNC(entry.devfn)); - continue; - } - pci_print_aer(pdev, entry.severity, entry.regs); + else + pci_print_aer(pdev, entry.severity, entry.regs); =20 /* * Memory for aer_capability_regs(entry.regs) is being @@ -1385,13 +1384,15 @@ static void aer_recover_work_func(struct work_struc= t *work) ghes_estatus_pool_region_free((unsigned long)entry.regs, sizeof(struct aer_capability_regs)); =20 - if (entry.severity =3D=3D AER_NONFATAL) - pcie_do_recovery(pdev, pci_channel_io_normal, - aer_root_reset); - else if (entry.severity =3D=3D AER_FATAL) - pcie_do_recovery(pdev, pci_channel_io_frozen, - aer_root_reset); - pci_dev_put(pdev); + if (pdev) { + if (entry.severity =3D=3D AER_NONFATAL) + pcie_do_recovery(pdev, pci_channel_io_normal, + aer_root_reset); + else if (entry.severity =3D=3D AER_FATAL) + pcie_do_recovery(pdev, pci_channel_io_frozen, + aer_root_reset); + pci_dev_put(pdev); + } } } =20 --=20 2.56.0.rc1.315.gc6ed9934b7-goog From nobody Fri Oct 2 07:47:18 2026 Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA4C94E8E06 for ; Mon, 28 Sep 2026 17:40:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790617239; cv=none; b=rnvYDWe0A+uxt0LOIKK6LFo7VirtOoFLGgAbIOwIi21xtEW6SzuNOXVSqJiOJTxH38OulzEHGKzh/qpG62WCx/cFnXgZ0enPfwchBZ8MlKWcj6WZtjYMqS7LtMp9irIA4aLEQkgM69xmviAi6JQFq3c4+ALuPjHokiCfszyOYSA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790617239; c=relaxed/simple; bh=DrrpmMgqYm/UCDYIJMppjRzVQ0lH6SCyvXay+DqFGyc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=EHiq8ea434aE5f+XLdbRnaKCZKfHWYrWUr2Qe5i6Fujjilylts6oyVcnRE+D27fW9Jgog9DWnHgVcZseZZM38zQTBdvN0UVMCLAoGM8SbF56x5LXLcRvqgmmPNAsGlc7BbWacuWHP7UziUmyVPdSYFaOBbVIQqx7MthWwlcgZtE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=KTsmG9dq; arc=none smtp.client-ip=209.85.215.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--rathodpriyank.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="KTsmG9dq" Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-cbb92868263so2122634a12.2 for ; Mon, 28 Sep 2026 10:40:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1790617237; x=1791222037; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=tB5j9Ieax5DH9zx0vt2uvs8E8GXW1JSopJdrsg1Gquo=; b=KTsmG9dqG+Bb3PeK7AbBPRD7gQgiOfYDv9kP/oIhyWRC2McXidM2OMXKaMvbSkDGx0 QthMyvoYX0zoGvpyrtPeEqDfwjitkovQRO5Xa0qujsURtMaxzOxivFRDnBS+EZBPioJ9 F45TCdTNtyhmfQHctQzQphZpKSNZzPdnPcfFnrxjfUgtIOoGdSpuWYGaPDe3ghLcN7b0 NvLEGCSrIlG5xOOavrEqEco5vxA3VYwWqgD3Y4+aGgLlXdTuMBXfDM0SI/LZUNoBPQxh gcXvyeytjtRCwywDlGFGYoC6mtcaAIR46pv/SQOay+alCWxqos1lDUKvrqP2cVlTN9xI QKIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790617237; x=1791222037; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tB5j9Ieax5DH9zx0vt2uvs8E8GXW1JSopJdrsg1Gquo=; b=J49YuQZqVlmjl5l/gRslpRWz5uQ74k73Yc6OHvzEfhxxGdh7cEXPl+uYhJR50iVN6R Ck9KcxA5W5nKR99Lfk1b7N5OvXffvwPqyJlR5BiYAAW2Y+z+78r9mX4MwJcUHVmsRpQ2 a4sYbwtdm5q4uorLSSWWzAVsteolSFbyQMEygykARIVOY2VnsoobzrmvQtYbLtLx+fV2 HJnVRhCp+Wk1AYTg/Ro2ECqzQr9zh1/XRZ4A4x8x7FWuk8fbbjd4O3rkyDTIfCtxtoBh MyfezjTcNTcISB+vtnIIWZrLga17lwvuMgrcCqEe+XnO1rX6VQ5TxPLXlOF/M5SIwN2P fJ8Q== X-Forwarded-Encrypted: i=1; AKwUvBxDZiJXClyG526OOc3JnhEUmCFMcpUgGv95+bVgSSsoodE8Bq5PWVRvesG17xO0FDXyR/K/G0qELbV9Idw=@vger.kernel.org X-Gm-Message-State: AFuF++kJeElPdpKsS3/qr8/9mpyd3oBP/ij/uplDH2v8Nq9+EKc3Qr8q y9b0bStrNWQzWvgRQF4pc046IxdxX3v1LStKnllAV6ZOVAOhrS3m2vdrpROHP65rnccWTy+4wGF zqOBKduH2UbPvoq9aPKpDKqLXxGtcPk3Wsg== X-Received: from pgbgf16.prod.google.com ([2002:a05:6a02:2cd0:b0:cc7:b01e:d448]) (user=rathodpriyank job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:3d1d:b0:3d7:b3c1:cc34 with SMTP id adf61e73a8af0-3de0e76e738mr10931497637.26.1790617236401; Mon, 28 Sep 2026 10:40:36 -0700 (PDT) Date: Mon, 28 Sep 2026 17:40:14 +0000 In-Reply-To: <20260928-b4-fix-aer-memleaks-v5-0-ba6b94c9c9a6@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260928-b4-fix-aer-memleaks-v5-0-ba6b94c9c9a6@google.com> X-Mailer: b4 0.14.3 Message-ID: <20260928-b4-fix-aer-memleaks-v5-3-ba6b94c9c9a6@google.com> Subject: [PATCH v5 3/3] PCI/AER: Document that aer_recover_queue() takes ownership of aer_regs From: Priyank Rathod To: Mahesh J Salgaonkar , "Oliver O'Halloran" , Bjorn Helgaas Cc: Lukas Wunner , Kuppuswamy Sathyanarayanan , Jonathan Cameron , "=?utf-8?q?Ilpo_J=C3=A4rvinen?=" , Dave Jiang , Shiju Jose , "Rafael J. Wysocki" , linuxppc-dev@lists.ozlabs.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Priyank Rathod Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable ghes_handle_aer() allocates the AER register snapshot that it passes to aer_recover_queue() from ghes_estatus_pool. aer_recover_queue() returns void, so the caller cannot tell whether the record was queued, and the AER code owns the buffer from then on and must free it on every path. None of this is documented at the definition of this exported function. With GHES enabled, a new caller that passed a buffer from any other allocator would hit the BUG() in gen_pool_free_owner() when the AER code returns the buffer to ghes_estatus_pool, and a caller that freed the buffer itself would cause a double free. Add a kernel-doc comment that describes the parameters and states that aer_recover_queue() takes ownership of @aer_regs, which must have been allocated from ghes_estatus_pool. No functional change. Suggested-by: Kuppuswamy Sathyanarayanan Link: https://lore.kernel.org/r/4513e7d4-4e2f-42d8-8f0c-2f0e03815dee@linux.= intel.com Signed-off-by: Priyank Rathod --- drivers/pci/pcie/aer.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c index a6600801af6e..a58244e00bc4 100644 --- a/drivers/pci/pcie/aer.c +++ b/drivers/pci/pcie/aer.c @@ -1404,6 +1404,24 @@ static void aer_recover_work_func(struct work_struct= *work) static DEFINE_SPINLOCK(aer_recover_ring_lock); static DECLARE_WORK(aer_recover_work, aer_recover_work_func); =20 +/** + * aer_recover_queue - queue an AER error record reported by firmware + * @domain: PCI domain (segment) of the device that reported the error + * @bus: bus number of the device that reported the error + * @devfn: encoded device and function number, as returned by PCI_DEVFN() + * @severity: AER_CORRECTABLE, AER_NONFATAL or AER_FATAL + * @aer_regs: snapshot of the device's AER Capability registers + * + * Queue an error record received from firmware through APEI GHES. The + * record is processed later from a workqueue, which logs the error and, + * for uncorrectable errors, attempts recovery of the device. + * + * Takes ownership of @aer_regs, which must have been allocated from + * ghes_estatus_pool with a size of sizeof(struct aer_capability_regs). + * The buffer is freed with ghes_estatus_pool_region_free() by the work + * item that processes the record, or immediately if the queue is full. + * The caller must not access or free @aer_regs after this call. + */ void aer_recover_queue(int domain, unsigned int bus, unsigned int devfn, int severity, struct aer_capability_regs *aer_regs) { --=20 2.56.0.rc1.315.gc6ed9934b7-goog