Re: [PATCH v3 1/4] s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()

From: Niklas Schnelle

Date: Fri Sep 18 2026 - 04:35:44 EST


On Fri, 2026-09-18 at 10:17 +0200, Benjamin Block wrote:
> On Wed, Sep 16, 2026 at 05:14:10PM +0200, Niklas Schnelle wrote:
> > In zpci_report_status(), a reference to the pdev associated with the
> > zdev being reported about is acquired using pci_get_slot(). This
> > reference needs to be dropped with pci_dev_put(), but this call is
> > missing, thus leaking the reference. On subsequent hot unplug, this will
> > cause the struct pci_dev to not be released, leaking memory and
> > preventing reattach.
> >
> > At the same time, the only existing caller already holds a pdev
> > reference. So instead of reacquiring and then dropping another reference,
> > simply pass the existing pdev pointer to zpci_report_status(). This gets
> > rid of the need for pci_get_slot() as well as the zdev->zbus check.
> >
> > Cc: stable@xxxxxxxxxxxxxxx
> > Fixes: 4ec6054e7321 ("s390/pci: Report PCI error recovery results via SCLP")
> > Signed-off-by: Niklas Schnelle <schnelle@xxxxxxxxxxxxx>
> > ---
> > arch/s390/pci/pci_event.c | 2 +-
> > arch/s390/pci/pci_report.c | 11 +++++------
> > arch/s390/pci/pci_report.h | 4 +++-
> > 3 files changed, 9 insertions(+), 8 deletions(-)
> >
> > diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
> > index f317a1465dad..3b4941b65840 100644
> > --- a/arch/s390/pci/pci_event.c
> > +++ b/arch/s390/pci/pci_event.c
> > @@ -298,7 +298,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev,
> > pci_uevent_ers(pdev, PCI_ERS_RESULT_RECOVERED);
> > out_unlock:
> > device_unlock(&pdev->dev);
> > - zpci_report_status(zdev, "recovery", status_str);
> > + zpci_report_status(zdev, pdev, "recovery", status_str);
>
> Hmm. Wasn't one of the previous fixes to move the lock below the status
> report?
>
> Why is that missing here again?
>

You're right and this is needed. I just moved it into a separate patch
to have more cohesion within this patch.

Thanks,
Niklas