Re: [PATCH v2] uio: fix IRQ vector leak on probe failure and remove

[Greg Kroah-Hartman]

On Sun, May 24, 2026 at 02:42:01PM +0800, Guangshuo Li wrote:
> probe() allocates MSI/MSI-X vectors with pci_alloc_irq_vectors(), but
> neither the error path nor remove() releases them with
> pci_free_irq_vectors().
> 
> Unlike drivers using pcim_enable_device(), this driver uses
> pci_enable_device(), so the IRQ vectors are not managed automatically
> and must be freed explicitly.
> 
> Add pci_free_irq_vectors() to the probe error path after successful
> vector allocation and to remove(). The issue was identified by a
> static analysis tool I developed.
> 
> Fixes: 3397c3cd859a ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---
> v2:
>   - Change have_irq_vectors from int to bool.
>   - Set have_irq_vectors immediately after successful IRQ vector allocation.
> 
>  drivers/uio/uio_pci_generic_sva.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
> index 4a46acd994a8..e216436c9116 100644
> --- a/drivers/uio/uio_pci_generic_sva.c
> +++ b/drivers/uio/uio_pci_generic_sva.c
> @@ -63,6 +63,7 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  {
>  	struct uio_pci_sva_dev *udev;
>  	int ret, i, irq = 0;
> +	bool have_irq_vectors = false;
>  
>  	ret = pci_enable_device(pdev);
>  	if (ret) {
> @@ -78,6 +79,8 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  
>  	ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSIX | PCI_IRQ_MSI);
>  	if (ret > 0) {
> +		have_irq_vectors = true;
> +
>  		irq = pci_irq_vector(pdev, 0);
>  		if (irq < 0) {
>  			dev_err(&pdev->dev, "Failed to get MSI vector\n");
> @@ -139,6 +142,8 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  out_free:
>  	kfree(udev);
>  out_disable:
> +	if (have_irq_vectors)
> +		pci_free_irq_vectors(pdev);
>  	pci_disable_device(pdev);
>  
>  	return ret;
> @@ -148,6 +153,7 @@ static void remove(struct pci_dev *pdev)
>  {
>  	struct uio_pci_sva_dev *udev = pci_get_drvdata(pdev);
>  
> +	pci_free_irq_vectors(pdev);
>  	pci_release_regions(pdev);
>  	pci_disable_device(pdev);
>  	kfree(udev);
> -- 
> 2.43.0
> 
> 

Does not apply to linux-next :(