[PATCH] uio: fix IRQ vector leak on probe failure and remove

From: Guangshuo Li

Date: Thu Apr 16 2026 - 11:55:17 EST


probe() allocates MSI/MSI-X vectors with pci_alloc_irq_vectors(), but
neither the error path nor remove() releases them with
pci_free_irq_vectors().

Unlike drivers using pcim_enable_device(), this driver uses
pci_enable_device(), so the IRQ vectors are not managed automatically
and must be freed explicitly.

Add pci_free_irq_vectors() to the probe error path after successful
vector allocation and to remove(). The issue was identified by a
static analysis tool I developed.

Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
drivers/uio/uio_pci_generic_sva.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
index 4a46acd994a8..ea531f9a164c 100644
--- a/drivers/uio/uio_pci_generic_sva.c
+++ b/drivers/uio/uio_pci_generic_sva.c
@@ -62,7 +62,7 @@ static int uio_pci_sva_release(struct uio_info *info, struct inode *inode)
static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
{
struct uio_pci_sva_dev *udev;
- int ret, i, irq = 0;
+ int ret, i, irq = 0, have_irq_vectors = 0;

ret = pci_enable_device(pdev);
if (ret) {
@@ -83,6 +83,7 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
dev_err(&pdev->dev, "Failed to get MSI vector\n");
ret = irq;
goto out_disable;
+ have_irq_vectors = 1;
}
} else
dev_warn(&pdev->dev,
@@ -139,6 +140,8 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
out_free:
kfree(udev);
out_disable:
+ if (have_irq_vectors)
+ pci_free_irq_vectors(pdev);
pci_disable_device(pdev);

return ret;
@@ -148,6 +151,7 @@ static void remove(struct pci_dev *pdev)
{
struct uio_pci_sva_dev *udev = pci_get_drvdata(pdev);

+ pci_free_irq_vectors(pdev);
pci_release_regions(pdev);
pci_disable_device(pdev);
kfree(udev);
--
2.43.0