[PATCH] PCI/PTM: fix refcount leak in pci_enable_ptm()

[PATCH] PCI/PTM: fix refcount leak in pci_enable_ptm()

[Wentao Liang]

When pci_enable_ptm() enables PTM for a device, it first
recursively calls itself on the parent. This increments the
parent's ptm_enable_cnt. If the subsequent __pci_enable_ptm()
call on the child fails, the error path only decrements the
child's ptm_enable_cnt but leaves the parent's counter
elevated. That refcount is never balanced, leading to a leak.

Fix this by calling pci_disable_ptm() for the parent on the
error path, reverting the parent's enable state. Add the call
right after the child's counter is decremented.

Cc: stable@vger.kernel.org
Fixes: e8bdc5ea4816 ("PCI/PTM: Add pci_suspend_ptm() and pci_resume_ptm()")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/pci/pcie/ptm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c
index a41ffd1914de..01f6c7da7ca9 100644
--- a/drivers/pci/pcie/ptm.c
+++ b/drivers/pci/pcie/ptm.c
@@ -201,6 +201,8 @@ int pci_enable_ptm(struct pci_dev *dev)
 
 	rc = __pci_enable_ptm(dev);
 	if (rc) {
+		if (!dev->ptm_root)
+			pci_disable_ptm(parent);
 		atomic_dec(&dev->ptm_enable_cnt);
 		return rc;
 	}
-- 
2.34.1

Re: [PATCH] PCI/PTM: fix refcount leak in pci_enable_ptm()

[kernel test robot]

Hi Wentao,

kernel test robot noticed the following build errors:

[auto build test ERROR on pci/next]
[also build test ERROR on pci/for-linus westeri-thunderbolt/next linus/master v7.1 next-20260616]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Wentao-Liang/PCI-PTM-fix-refcount-leak-in-pci_enable_ptm/20260617-043856
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git next
patch link:    https://lore.kernel.org/r/20260616141733.1688264-1-vulab%40iscas.ac.cn
patch subject: [PATCH] PCI/PTM: fix refcount leak in pci_enable_ptm()
config: powerpc-randconfig-002-20260617 (https://download.01.org/0day-ci/archive/20260617/202606171116.hVjtUYrV-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260617/202606171116.hVjtUYrV-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606171116.hVjtUYrV-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/pci/pcie/ptm.c:204:20: error: use of undeclared identifier 'parent'
     204 |                         pci_disable_ptm(parent);
         |                                         ^
   1 error generated.


vim +/parent +204 drivers/pci/pcie/ptm.c

   162	
   163	/**
   164	 * pci_enable_ptm() - Enable Precision Time Measurement
   165	 * @dev: PCI device
   166	 *
   167	 * Enable Precision Time Measurement for @dev.
   168	 *
   169	 * Return: zero if successful, or -EINVAL if @dev lacks a PTM Capability or
   170	 * is not a PTM Root and lacks an upstream path of PTM-enabled devices.
   171	 */
   172	int pci_enable_ptm(struct pci_dev *dev)
   173	{
   174		int rc;
   175		char clock_desc[8];
   176	
   177		/*
   178		 * A device uses local PTM Messages to request time information
   179		 * from a PTM Root that's farther upstream. Every device along
   180		 * the path must support PTM and have it enabled so it can
   181		 * handle the messages. Therefore, if this device is not a PTM
   182		 * Root, the upstream link partner must have PTM enabled before
   183		 * we can enable PTM.
   184		 */
   185		if (!dev->ptm_root) {
   186			struct pci_dev *parent;
   187	
   188			parent = pci_upstream_ptm(dev);
   189			if (!parent)
   190				return -EINVAL;
   191			/* Enable PTM for the parent */
   192			rc = pci_enable_ptm(parent);
   193			if (rc)
   194				return rc;
   195		}
   196	
   197		/* Already enabled? */
   198		if (atomic_inc_return(&dev->ptm_enable_cnt) > 1)
   199			return 0;
   200	
   201		rc = __pci_enable_ptm(dev);
   202		if (rc) {
   203			if (!dev->ptm_root)
 > 204				pci_disable_ptm(parent);
   205			atomic_dec(&dev->ptm_enable_cnt);
   206			return rc;
   207		}
   208	
   209		switch (dev->ptm_granularity) {
   210		case 0:
   211			snprintf(clock_desc, sizeof(clock_desc), "unknown");
   212			break;
   213		case 255:
   214			snprintf(clock_desc, sizeof(clock_desc), ">254ns");
   215			break;
   216		default:
   217			snprintf(clock_desc, sizeof(clock_desc), "%uns",
   218				 dev->ptm_granularity);
   219			break;
   220		}
   221		pci_info(dev, "PTM enabled%s, %s granularity\n",
   222			 dev->ptm_root ? " (root)" : "", clock_desc);
   223	
   224		return 0;
   225	}
   226	EXPORT_SYMBOL(pci_enable_ptm);
   227	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] PCI/PTM: fix refcount leak in pci_enable_ptm()

[kernel test robot]

Hi Wentao,

kernel test robot noticed the following build errors:

[auto build test ERROR on pci/next]
[also build test ERROR on pci/for-linus westeri-thunderbolt/next linus/master v7.1 next-20260616]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Wentao-Liang/PCI-PTM-fix-refcount-leak-in-pci_enable_ptm/20260617-043856
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git next
patch link:    https://lore.kernel.org/r/20260616141733.1688264-1-vulab%40iscas.ac.cn
patch subject: [PATCH] PCI/PTM: fix refcount leak in pci_enable_ptm()
config: s390-randconfig-r072-20260617 (https://download.01.org/0day-ci/archive/20260617/202606171537.E42T5ZLo-lkp@intel.com/config)
compiler: s390-linux-gcc (GCC) 8.5.0
smatch: v0.5.0-9185-gbcc58b9c
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260617/202606171537.E42T5ZLo-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202606171537.E42T5ZLo-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/pci/pcie/ptm.c: In function 'pci_enable_ptm':
>> drivers/pci/pcie/ptm.c:204:20: error: 'parent' undeclared (first use in this function); did you mean 'xa_parent'?
       pci_disable_ptm(parent);
                       ^~~~~~
                       xa_parent
   drivers/pci/pcie/ptm.c:204:20: note: each undeclared identifier is reported only once for each function it appears in


vim +204 drivers/pci/pcie/ptm.c

   162	
   163	/**
   164	 * pci_enable_ptm() - Enable Precision Time Measurement
   165	 * @dev: PCI device
   166	 *
   167	 * Enable Precision Time Measurement for @dev.
   168	 *
   169	 * Return: zero if successful, or -EINVAL if @dev lacks a PTM Capability or
   170	 * is not a PTM Root and lacks an upstream path of PTM-enabled devices.
   171	 */
   172	int pci_enable_ptm(struct pci_dev *dev)
   173	{
   174		int rc;
   175		char clock_desc[8];
   176	
   177		/*
   178		 * A device uses local PTM Messages to request time information
   179		 * from a PTM Root that's farther upstream. Every device along
   180		 * the path must support PTM and have it enabled so it can
   181		 * handle the messages. Therefore, if this device is not a PTM
   182		 * Root, the upstream link partner must have PTM enabled before
   183		 * we can enable PTM.
   184		 */
   185		if (!dev->ptm_root) {
   186			struct pci_dev *parent;
   187	
   188			parent = pci_upstream_ptm(dev);
   189			if (!parent)
   190				return -EINVAL;
   191			/* Enable PTM for the parent */
   192			rc = pci_enable_ptm(parent);
   193			if (rc)
   194				return rc;
   195		}
   196	
   197		/* Already enabled? */
   198		if (atomic_inc_return(&dev->ptm_enable_cnt) > 1)
   199			return 0;
   200	
   201		rc = __pci_enable_ptm(dev);
   202		if (rc) {
   203			if (!dev->ptm_root)
 > 204				pci_disable_ptm(parent);
   205			atomic_dec(&dev->ptm_enable_cnt);
   206			return rc;
   207		}
   208	
   209		switch (dev->ptm_granularity) {
   210		case 0:
   211			snprintf(clock_desc, sizeof(clock_desc), "unknown");
   212			break;
   213		case 255:
   214			snprintf(clock_desc, sizeof(clock_desc), ">254ns");
   215			break;
   216		default:
   217			snprintf(clock_desc, sizeof(clock_desc), "%uns",
   218				 dev->ptm_granularity);
   219			break;
   220		}
   221		pci_info(dev, "PTM enabled%s, %s granularity\n",
   222			 dev->ptm_root ? " (root)" : "", clock_desc);
   223	
   224		return 0;
   225	}
   226	EXPORT_SYMBOL(pci_enable_ptm);
   227	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki