[PATCH] PCI/IOV: drop PF reference if max VF bus computation fails

[Wentao Liang]

sriov_init() takes a reference on the PF found on the bus and stores it
in iov->dev.  The reference is normally released by sriov_release()
through sriov_disable().  But if compute_max_vf_buses() fails, the
error path clears dev->sriov and frees the iov without dropping that
reference, so the PF device refcount is leaked once per failed SR-IOV
initialisation.

Release the PF reference on that path before freeing the iov.

Fixes: ea9a8854161d ("PCI: Set SR-IOV NumVFs to zero after enumeration")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/pci/iov.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index 9185934a900f..b7ab7e0f6fcb 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -880,6 +880,8 @@ static int sriov_init(struct pci_dev *dev, int pos)
 	return 0;
 
 fail_max_buses:
+	if (pdev)
+		pci_dev_put(pdev);
 	dev->sriov = NULL;
 	dev->is_physfn = 0;
 failed:
-- 
2.34.1