Re: [PATCH] fix: drivers/video: __screen_info_pci_dev: leaked pci_dev references in pci_get_base_class loop

[Jani Nikula]

On Sat, 27 Jun 2026, Helge Deller <deller@xxxxxx> wrote:
> On 6/27/26 05:44, WenTao Liang wrote:
>> In __screen_info_pci_dev(), the loop uses pci_get_base_class() with a
>> non-NULL starting device pdev. Each iteration returns a new device
>> reference but does not release the previous one. When a non-matching
>> device is found, pdev is overwritten and the previous reference leaks.
>> When no match is found, all acquired references are leaked.
>> 
>> Add pci_dev_put(pdev) for non-matching devices before continuing the loop.
>> 
>> Cc: stable@xxxxxxxxxxxxxxx
>> Fixes: 036105e3a776 ("video: Provide screen_info_get_pci_dev() to find screen_info's PCI device")
>> Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
>> ---
>>   drivers/video/screen_info_pci.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>> 
>> diff --git a/drivers/video/screen_info_pci.c b/drivers/video/screen_info_pci.c
>> index 8f34d8a74f09..c821101e9304 100644
>> --- a/drivers/video/screen_info_pci.c
>> +++ b/drivers/video/screen_info_pci.c
>> @@ -123,6 +123,10 @@ static struct pci_dev *__screen_info_pci_dev(struct resource *res)
>>   
>>   	while (!r && (pdev = pci_get_base_class(PCI_BASE_CLASS_DISPLAY, pdev))) {
>>   		r = pci_find_resource(pdev, res);
>> +		if (!r) {
>> +			pci_dev_put(pdev);
>> +			pdev = NULL;
>> +		}
>
> Have you tested the code?
> If pdev gets assigned NULL, doesn't that introduce an endless loop?
> And, similar code is in amdgpu*  and google's framebuffer-coreboot.c files, so if
> this is correct, don't they need fixing as well?

More specifically, pci_get_base_class() decrements the passed in "from"
refcount if it's not NULL.

BR,
Jani.


-- 
Jani Nikula, Intel