[PATCH] uio: fix IRQ vector leak on probe failure and remove

[PATCH] uio: fix IRQ vector leak on probe failure and remove

[Guangshuo Li]

probe() allocates MSI/MSI-X vectors with pci_alloc_irq_vectors(), but
neither the error path nor remove() releases them with
pci_free_irq_vectors().

Unlike drivers using pcim_enable_device(), this driver uses
pci_enable_device(), so the IRQ vectors are not managed automatically
and must be freed explicitly.

Add pci_free_irq_vectors() to the probe error path after successful
vector allocation and to remove(). The issue was identified by a
static analysis tool I developed.

Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/uio/uio_pci_generic_sva.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
index 4a46acd994a8..ea531f9a164c 100644
--- a/drivers/uio/uio_pci_generic_sva.c
+++ b/drivers/uio/uio_pci_generic_sva.c
@@ -62,7 +62,7 @@ static int uio_pci_sva_release(struct uio_info *info, struct inode *inode)
 static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	struct uio_pci_sva_dev *udev;
-	int ret, i, irq = 0;
+	int ret, i, irq = 0, have_irq_vectors = 0;
 
 	ret = pci_enable_device(pdev);
 	if (ret) {
@@ -83,6 +83,7 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
 			dev_err(&pdev->dev, "Failed to get MSI vector\n");
 			ret = irq;
 			goto out_disable;
+			have_irq_vectors = 1;
 		}
 	} else
 		dev_warn(&pdev->dev,
@@ -139,6 +140,8 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
 out_free:
 	kfree(udev);
 out_disable:
+	if (have_irq_vectors)
+		pci_free_irq_vectors(pdev);
 	pci_disable_device(pdev);
 
 	return ret;
@@ -148,6 +151,7 @@ static void remove(struct pci_dev *pdev)
 {
 	struct uio_pci_sva_dev *udev = pci_get_drvdata(pdev);
 
+	pci_free_irq_vectors(pdev);
 	pci_release_regions(pdev);
 	pci_disable_device(pdev);
 	kfree(udev);
-- 
2.43.0

Re: [PATCH] uio: fix IRQ vector leak on probe failure and remove

[Greg Kroah-Hartman]

On Thu, Apr 16, 2026 at 11:54:43PM +0800, Guangshuo Li wrote:
> probe() allocates MSI/MSI-X vectors with pci_alloc_irq_vectors(), but
> neither the error path nor remove() releases them with
> pci_free_irq_vectors().
> 
> Unlike drivers using pcim_enable_device(), this driver uses
> pci_enable_device(), so the IRQ vectors are not managed automatically
> and must be freed explicitly.
> 
> Add pci_free_irq_vectors() to the probe error path after successful
> vector allocation and to remove(). The issue was identified by a
> static analysis tool I developed.
> 
> Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/uio/uio_pci_generic_sva.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
> index 4a46acd994a8..ea531f9a164c 100644
> --- a/drivers/uio/uio_pci_generic_sva.c
> +++ b/drivers/uio/uio_pci_generic_sva.c
> @@ -62,7 +62,7 @@ static int uio_pci_sva_release(struct uio_info *info, struct inode *inode)
>  static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  {
>  	struct uio_pci_sva_dev *udev;
> -	int ret, i, irq = 0;
> +	int ret, i, irq = 0, have_irq_vectors = 0;

have_irq_vectors should be a bool.

Re: [PATCH] uio: fix IRQ vector leak on probe failure and remove

[Guangshuo Li]

Hi Greg,

Thank you for reviewing the patch.

On Fri, 22 May 2026 at 18:03, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Thu, Apr 16, 2026 at 11:54:43PM +0800, Guangshuo Li wrote:
> > probe() allocates MSI/MSI-X vectors with pci_alloc_irq_vectors(), but
> > neither the error path nor remove() releases them with
> > pci_free_irq_vectors().
> >
> > Unlike drivers using pcim_enable_device(), this driver uses
> > pci_enable_device(), so the IRQ vectors are not managed automatically
> > and must be freed explicitly.
> >
> > Add pci_free_irq_vectors() to the probe error path after successful
> > vector allocation and to remove(). The issue was identified by a
> > static analysis tool I developed.
> >
> > Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > ---
> >  drivers/uio/uio_pci_generic_sva.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
> > index 4a46acd994a8..ea531f9a164c 100644
> > --- a/drivers/uio/uio_pci_generic_sva.c
> > +++ b/drivers/uio/uio_pci_generic_sva.c
> > @@ -62,7 +62,7 @@ static int uio_pci_sva_release(struct uio_info *info, struct inode *inode)
> >  static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
> >  {
> >       struct uio_pci_sva_dev *udev;
> > -     int ret, i, irq = 0;
> > +     int ret, i, irq = 0, have_irq_vectors = 0;
>
> have_irq_vectors should be a bool.

I will change have_irq_vectors to a bool and send a v2.

Best regards,
Guangshuo