Skip to content

Commit b6422df

Browse files
Sahil Chandnaliuw
authored andcommitted
PCI: hv: Fix double ida_free in hv_pci_probe error path
If hv_pci_probe() fails after storing the domain number in hbus->bridge->domain_nr, there is a call to free this domain_nr via pci_bus_release_emul_domain_nr(), however, during cleanup, the bridge release callback pci_release_host_bridge_dev() also frees the domain_nr causing ida_free to be called on same ID twice and triggering following warning: ida_free called for id=28971 which is not allocated. WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198 Call Trace: pci_bus_release_emul_domain_nr+0x17/0x20 pci_release_host_bridge_dev+0x4b/0x60 device_release+0x3b/0xa0 kobject_put+0x8e/0x220 devm_pci_alloc_host_bridge_release+0xe/0x20 devres_release_all+0x9a/0xd0 device_unbind_cleanup+0x12/0xa0 really_probe+0x1c5/0x3f0 vmbus_add_channel_work+0x135/0x1a0 Fix this by letting pci core handle the free domain_nr and remove the explicit free called in pci-hyperv driver. Fixes: bcce8c7 ("PCI: Enable host bridge emulation for PCI_DOMAINS_GENERIC platforms") Signed-off-by: Sahil Chandna <[email protected]> Reviewed-by: Manivannan Sadhasivam <[email protected]> Reviewed-by: Saurabh Sengar <[email protected]> Signed-off-by: Wei Liu <[email protected]>
1 parent 7b3b1e5 commit b6422df

1 file changed

Lines changed: 1 addition & 3 deletions

File tree

drivers/pci/controller/pci-hyperv.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3786,7 +3786,7 @@ static int hv_pci_probe(struct hv_device *hdev,
37863786
hbus->bridge->domain_nr);
37873787
if (!hbus->wq) {
37883788
ret = -ENOMEM;
3789-
goto free_dom;
3789+
goto free_bus;
37903790
}
37913791

37923792
hdev->channel->next_request_id_callback = vmbus_next_request_id;
@@ -3882,8 +3882,6 @@ static int hv_pci_probe(struct hv_device *hdev,
38823882
vmbus_close(hdev->channel);
38833883
destroy_wq:
38843884
destroy_workqueue(hbus->wq);
3885-
free_dom:
3886-
pci_bus_release_emul_domain_nr(hbus->bridge->domain_nr);
38873885
free_bus:
38883886
kfree(hbus);
38893887
return ret;

0 commit comments

Comments
 (0)