Re: [PATCH v2] xen/pcifront: Fix PCI device reference leak in AER handling
Lukas Wunner <[email protected]>
| Newsgroups | org.xenproject.lists.xen-devel,org.kernel.vger.linux-kernel,org.kernel.vger.linux-pci |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Aug 20, 2026 at 09:56:03PM +0800, Ruoyu Wang wrote:
> pci_get_domain_bus_and_slot() increments the reference count of the
> returned PCI device. pcifront_common_process() drops that reference only
> when the device or its driver is missing. All paths for a bound device
> either return directly after invoking an error recovery callback or fall
> through without calling pci_dev_put(). Consequently, each AER request for
> a bound device leaks a reference and can keep the device allocated after
> removal.
>
> Declare the looked-up device with __free(pci_dev_put), so every return
> path releases the reference after callback dispatch. This keeps the
> device alive while its callback runs and balances the lookup without
> restructuring the callback returns.
>
> This issue was found by a static analysis checker and confirmed by manual
> source review.
>
> Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.")
> Suggested-by: Lukas Wunner <[email protected]>
> Signed-off-by: Ruoyu Wang <[email protected]>
Reviewed-by: Lukas Wunner <[email protected]>