pci_get_slot() returns a device with its reference count incremented. When the loop ends on tp->pdev (which happens when the adapter sits at PCI function 7 and no other function is present) that reference has already been dropped inside the loop, but the trailing pci_dev_put() drops it a second time, underflowing the refcount of tp->pdev. Treat a loop end on tp->pdev as single-port mode, just like the existing !peer case. Fixes: 16fe9d74f14e ("[TG3]: Fix 5704 single-port mode") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/net/ethernet/broadcom/tg3.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 73a4b569b03e..57669a22c036 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -16122,9 +16122,10 @@ static struct pci_dev *tg3_find_peer(struct tg3 *tp) pci_dev_put(peer); } /* 5704 can be configured in single-port mode, set peer to - * tp->pdev in that case. + * tp->pdev in that case. The loop can also end on tp->pdev + * itself, whose reference was already dropped above. */ - if (!peer) { + if (!peer || peer == tp->pdev) { peer = tp->pdev; return peer; } -- 2.34.1