Re: [PATCH] xen/pcifront: Fix PCI device reference leak in AER handling

[Jürgen Groß]

On 13.08.26 17:31, Ruoyu Wang wrote:
> pci_get_domain_bus_and_slot() increments the reference count of the
> returned PCI device. pcifront_common_process() drops that reference only
> when the device or its driver is missing. All paths for a bound device
> either return directly after invoking an error recovery callback or fall
> through without calling pci_dev_put(). Consequently, each AER request for
> a bound device leaks a reference and can keep the device allocated after
> removal.
>
> Store the callback result, release the reference after callback dispatch,
> and then return the result. This keeps the device alive while its callback
> runs and balances the lookup on every successful path.
>
> This issue was found by a static analysis checker and confirmed by manual
> source review.
>
> Fixes: 956a9202cd12 ("xen-pcifront: Xen PCI frontend driver.")
> Signed-off-by: Ruoyu Wang <ruoyuw560@xxxxxxxxx>

Reviewed-by: Juergen Gross <jgross@xxxxxxxx>


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature