Re: [PATCH] scsi: qla2xxx: fix refcount leak in qla24xx_async_prli()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Double-decrement (underflow) of `vha->vref_count` on the error path of `qla24xx_async_prli()`.
--

commit 96156510fc7447ae3d281225a3388973efa74abd
Author: WenTao Liang <vulab@iscas.ac.cn>

scsi: qla2xxx: fix refcount leak in qla24xx_async_prli()

This commit attempts to fix a vha refcount leak in the error path of
qla24xx_async_prli by explicitly calling QLA_VHA_MARK_NOT_BUSY(vha) after
releasing the command kref.

> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index e746c9274cded..8dd717dfcc144 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c
> @@ -1352,6 +1352,7 @@ qla24xx_async_prli(struct scsi_qla_host *vha, fc_port_t *fcport)
>  done_free_sp:
>  	/* ref: INIT */
>  	kref_put(&sp->cmd_kref, qla2x00_sp_release);
> +	QLA_VHA_MARK_NOT_BUSY(vha);

[Severity: High]
Does this result in a double-decrement of the vha refcount?

Looking at the release callback chain, kref_put() calls qla2x00_sp_release(),
which unconditionally calls sp->free(sp).

During initialization, qla2x00_init_async_sp() sets the free callback to
qla2x00_sp_free(), which then calls qla2x00_rel_sp(). Finally,
qla2x00_rel_sp() calls QLA_VHA_MARK_NOT_BUSY(sp->vha).

If the refcount is already decremented by the kref_put() callback chain:

kref_put()
  qla2x00_sp_release()
    qla2x00_sp_free()
      qla2x00_rel_sp()
        QLA_VHA_MARK_NOT_BUSY()

Does adding an explicit call here cause an underflow?

>  	fcport->flags &= ~FCF_ASYNC_SENT;
>  	return rval;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611110919.74911-1-vulab@iscas.ac.cn?part=1