From 8d65decde9afd2bd78bcfffdc0df73b82a0b5509 Mon Sep 17 00:00:00 2001 From: Alex Williamson Date: Tue, 14 Jul 2026 09:36:03 -0400 Subject: [PATCH] vfio/pci: Release the VGA arbiter client on register_device() failure [ Upstream commit daedde7f024ecf88bc8e832ed40cf2c795f0796a ] The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio_pci_set_decode() only uses pci_dev state, but the original failure path could leave a callback with a freed vdev cookie. The stale registration also becomes unsafe again once the callback follows drvdata to the vfio device. Add the required VGA unwind callout. Fixes: 4aeec3984ddc ("vfio/pci: Re-order vfio_pci_probe()") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Alex Williamson Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260615191241.688297-3-alex.williamson@nvidia.com Signed-off-by: Alex Williamson Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/vfio/pci/vfio_pci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c index ea4e75be1884..2da7067d5c34 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -1899,6 +1899,7 @@ int vfio_pci_core_register_device(struct vfio_pci_core_device *vdev) out_power: if (!disable_idle_d3) vfio_pci_set_power_state(vdev, PCI_D0); + vfio_pci_vga_uninit(vdev); out_vf: vfio_pci_vf_uninit(vdev); out_group_put: