* [PATCH] iommu/amd: Fix PCI device reference leak in iommu_call_iopf_notifier()
@ 2026-09-16 18:58 Wentao Liang
2026-09-30 9:58 ` Vasant Hegde
0 siblings, 1 reply; 2+ messages in thread
From: Wentao Liang @ 2026-09-16 18:58 UTC (permalink / raw)
To: iommu
Cc: jgg, joro, linux-kernel, robin.murphy, suravee.suthikulpanit,
vasant.hegde, wei.huang2, will, Wentao Liang, stable
pci_get_domain_bus_and_slot() returns a PCI device with an elevated
reference count, but iommu_call_iopf_notifier() never drops it, neither
when the page request has been reported nor on the abort path.
Put the device reference on both exits.
Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/iommu/amd/ppr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c
index 1f8d2823bea4..1e4392b17bd8 100644
--- a/drivers/iommu/amd/ppr.c
+++ b/drivers/iommu/amd/ppr.c
@@ -151,6 +151,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
/* Submit event */
iommu_report_device_fault(&pdev->dev, &event);
+ pci_dev_put(pdev);
return;
@@ -159,6 +160,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]),
IOMMU_PAGE_RESP_FAILURE,
PPR_TAG(raw[0]) & 0x1FF);
+ pci_dev_put(pdev);
}
void amd_iommu_poll_ppr_log(struct amd_iommu *iommu)
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] iommu/amd: Fix PCI device reference leak in iommu_call_iopf_notifier()
2026-09-16 18:58 [PATCH] iommu/amd: Fix PCI device reference leak in iommu_call_iopf_notifier() Wentao Liang
@ 2026-09-30 9:58 ` Vasant Hegde
0 siblings, 0 replies; 2+ messages in thread
From: Vasant Hegde @ 2026-09-30 9:58 UTC (permalink / raw)
To: Wentao Liang, iommu
Cc: jgg, joro, linux-kernel, robin.murphy, suravee.suthikulpanit,
wei.huang2, will, stable
On 9/17/2026 12:28 AM, Wentao Liang wrote:
> pci_get_domain_bus_and_slot() returns a PCI device with an elevated
> reference count, but iommu_call_iopf_notifier() never drops it, neither
> when the page request has been reported nor on the abort path.
>
> Put the device reference on both exits.
Its already addressed by commit af3b69b16383.
-Vasant
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-30 9:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-16 18:58 [PATCH] iommu/amd: Fix PCI device reference leak in iommu_call_iopf_notifier() Wentao Liang
2026-09-30 9:58 ` Vasant Hegde
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®