[PATCH] iommu/amd: Fix PCI device reference leak in PPR handling

[PATCH] iommu/amd: Fix PCI device reference leak in PPR handling

[Ruoyu Wang]

pci_get_domain_bus_and_slot() takes a reference on the returned PCI
device. iommu_call_iopf_notifier() fails to release it after either
reporting a valid PPR fault or completing a rejected request. Each
handled request therefore leaks a reference and can prevent the PCI
device from being released.

Call pci_dev_put() after the final use of the lookup reference on both
paths.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/iommu/amd/ppr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c
index 1f8d2823bea42..1e4392b17bd8f 100644
--- a/drivers/iommu/amd/ppr.c
+++ b/drivers/iommu/amd/ppr.c
@@ -151,6 +151,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
 
 	/* Submit event */
 	iommu_report_device_fault(&pdev->dev, &event);
+	pci_dev_put(pdev);
 
 	return;
 
@@ -159,6 +160,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw)
 	amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]),
 			       IOMMU_PAGE_RESP_FAILURE,
 			       PPR_TAG(raw[0]) & 0x1FF);
+	pci_dev_put(pdev);
 }
 
 void amd_iommu_poll_ppr_log(struct amd_iommu *iommu)
-- 
2.51.0

Re: [PATCH] iommu/amd: Fix PCI device reference leak in PPR handling

[Markus Elfring]

…
> Call pci_dev_put() after the final use of the lookup reference on both
> paths.
…

How do you think about to apply the attribute “__free(pci_dev_put)”
also in the implementation of the function “iommu_call_iopf_notifier”?
https://elixir.bootlin.com/linux/v7.2-rc7/source/include/linux/pci.h#L1269

https://elixir.bootlin.com/linux/v7.2-rc7/source/drivers/iommu/amd/ppr.c#L107-L162

Regards,
Markus