[PATCH] xen-pciback: Fix pcistub_device ref leak in pcistub_get_gsi_from_sbdf()
From: Wentao Liang
Date: Wed Sep 16 2026 - 13:21:42 EST
pcistub_get_gsi_from_sbdf() obtains the stub device with
pcistub_device_find(), which returns it with its kref incremented, and
returns psdev->gsi without dropping that reference again. The caller
cannot release it either, so every lookup leaks one reference to the
stub device.
Release the reference after reading gsi.
Fixes: 2fae6bb7be32 ("xen/privcmd: Add new syscall to get gsi from dev")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
drivers/xen/xen-pciback/pci_stub.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 79a2b5dfd694..d1a335233aab 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -234,13 +234,16 @@ static int pcistub_get_gsi_from_sbdf(unsigned int sbdf)
int bus = PCI_BUS_NUM(sbdf);
int slot = PCI_SLOT(sbdf);
int func = PCI_FUNC(sbdf);
+ int gsi;
psdev = pcistub_device_find(domain, bus, slot, func);
-
if (!psdev)
return -ENODEV;
- return psdev->gsi;
+ gsi = psdev->gsi;
+ pcistub_device_put(psdev);
+
+ return gsi;
}
#endif
--
2.34.1