[PATCH] PCI: switchtec: Fix PCI device reference leak on probe failure

[PATCH] PCI: switchtec: Fix PCI device reference leak on probe failure

[Yige Jiang]

stdev_create() takes a pci_dev reference for stdev->pdev. When a
later step of switchtec_pci_probe() fails, err_put drops stdev->dev
but omits the PCI device reference. stdev_release() only frees
stdev, so the PCI device remains pinned after the failed probe.

Return the PCI device reference before putting stdev->dev, matching
the existing cleanup in stdev_create() and switchtec_pci_remove().

Fixes: df25461119d9 ("PCI: switchtec: Fix stdev_release() crash after surprise hot remove")
Signed-off-by: Yige Jiang <yigejiang86@gmail.com>
---
Based on linux-next next-20261102 (2637bdec0535).
Compile-tested: arm64, GCC 14.2.0, W=1, CONFIG_OF_DYNAMIC=y.
COMPILE_TEST=y.
Baseline and patched target objects built from this exact base.
No full kernel/module-link, hardware or runtime test was performed.
AI assistance was used for analysis and patch preparation.

 drivers/pci/switch/switchtec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index 5711aaa5df11..56a370ac9f27 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -1698,6 +1698,7 @@ err_exit_pci:
 	switchtec_exit_pci(stdev);
 err_put:
 	ida_free(&switchtec_minor_ida, MINOR(stdev->dev.devt));
+	pci_dev_put(stdev->pdev);
 	put_device(&stdev->dev);
 	return rc;
 }

base-commit: 2637bdec0535a2044cd830eba9a79363651d9043

Re: [PATCH] PCI: switchtec: Fix PCI device reference leak on probe failure

[Logan Gunthorpe]

On 2026-11-05 1:55 a.m., Yige Jiang wrote:
> stdev_create() takes a pci_dev reference for stdev->pdev. When a
> later step of switchtec_pci_probe() fails, err_put drops stdev->dev
> but omits the PCI device reference. stdev_release() only frees
> stdev, so the PCI device remains pinned after the failed probe.
> 
> Return the PCI device reference before putting stdev->dev, matching
> the existing cleanup in stdev_create() and switchtec_pci_remove().
> 
> Fixes: df25461119d9 ("PCI: switchtec: Fix stdev_release() crash after surprise hot remove")
> Signed-off-by: Yige Jiang <yigejiang86@gmail.com>

Thanks! This looks correct to me.

Reviewed-by: Logan Gunthorpe <logang@deltatee.com>

Re: [PATCH] PCI: switchtec: Fix PCI device reference leak on probe failure

[Bjorn Helgaas]

On Thu, Nov 05, 2026 at 03:55:01PM +0800, Yige Jiang wrote:
> stdev_create() takes a pci_dev reference for stdev->pdev. When a
> later step of switchtec_pci_probe() fails, err_put drops stdev->dev
> but omits the PCI device reference. stdev_release() only frees
> stdev, so the PCI device remains pinned after the failed probe.
> 
> Return the PCI device reference before putting stdev->dev, matching
> the existing cleanup in stdev_create() and switchtec_pci_remove().
> 
> Fixes: df25461119d9 ("PCI: switchtec: Fix stdev_release() crash after surprise hot remove")
> Signed-off-by: Yige Jiang <yigejiang86@gmail.com>

Applied to pci/switchtec for v7.5, thanks!

> ---
> Based on linux-next next-20261102 (2637bdec0535).
> Compile-tested: arm64, GCC 14.2.0, W=1, CONFIG_OF_DYNAMIC=y.
> COMPILE_TEST=y.
> Baseline and patched target objects built from this exact base.
> No full kernel/module-link, hardware or runtime test was performed.
> AI assistance was used for analysis and patch preparation.
> 
>  drivers/pci/switch/switchtec.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
> index 5711aaa5df11..56a370ac9f27 100644
> --- a/drivers/pci/switch/switchtec.c
> +++ b/drivers/pci/switch/switchtec.c
> @@ -1698,6 +1698,7 @@ err_exit_pci:
>  	switchtec_exit_pci(stdev);
>  err_put:
>  	ida_free(&switchtec_minor_ida, MINOR(stdev->dev.devt));
> +	pci_dev_put(stdev->pdev);
>  	put_device(&stdev->dev);
>  	return rc;
>  }
> 
> base-commit: 2637bdec0535a2044cd830eba9a79363651d9043