From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
To: linux-scsi@vger.kernel.org, martin.petersen@oracle.com
Cc: sathya.prakash@broadcom.com, ranjan.kumar@broadcom.com,
sumit.saxena@broadcom.com, sweeti.vandure@broadcom.com,
vishakhavc@google.com, ipylypiv@google.com,
Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Subject: [PATCH v2 09/17] mpi3mr: Fix target device reference leak in device removal handshake
Date: Wed, 26 Aug 2026 02:34:03 +0530 [thread overview]
Message-ID: <20260825210411.301535-10-chandrakanth.patil@broadcom.com> (raw)
In-Reply-To: <20260825210411.301535-1-chandrakanth.patil@broadcom.com>
The device removal handshake looks up the target device to update its
state but never drops the reference that the lookup takes.
Drop it once the state has been updated.
Fixes: 13ef29ea4aa0 ("scsi: mpi3mr: Add support for device add/remove event handling")
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
---
v2:
- No changes from v1.
drivers/scsi/mpi3mr/mpi3mr_os.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
index 2a35f146fe69..9aeec6146acb 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
@@ -2536,6 +2536,9 @@ static void mpi3mr_dev_rmhs_send_tm(struct mpi3mr_ioc *mrioc, u16 handle,
tgtdev->state = MPI3MR_DEV_REMOVE_HS_STARTED;
spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
+ if (tgtdev)
+ mpi3mr_tgtdev_put(tgtdev);
+
if (drv_cmd)
goto issue_cmd;
do {
--
2.52.0
next prev parent reply other threads:[~2026-08-25 15:44 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-25 21:03 [PATCH v2 00/17] scsi: mpi3mr: Fix out-of-bounds accesses and reference leaks Chandrakanth Patil
2026-08-25 21:03 ` [PATCH v2 01/17] mpi3mr: Fix buffer overflow in BSG passthrough request copy Chandrakanth Patil
2026-08-25 16:09 ` sashiko-bot
2026-08-25 21:03 ` [PATCH v2 02/17] mpi3mr: Fix out-of-bounds read when copying BSG MPI requests Chandrakanth Patil
2026-08-25 16:06 ` sashiko-bot
2026-08-25 21:03 ` [PATCH v2 03/17] mpi3mr: Fix I/O block counter leak on admin request post failure Chandrakanth Patil
2026-08-25 16:06 ` sashiko-bot
2026-08-25 21:03 ` [PATCH v2 04/17] mpi3mr: Fix target device reference leak in BSG task management Chandrakanth Patil
2026-08-25 16:05 ` sashiko-bot
2026-08-25 21:03 ` [PATCH v2 05/17] mpi3mr: Fix buffer overflow when caching log data Chandrakanth Patil
2026-08-25 16:12 ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 06/17] mpi3mr: Fix out-of-bounds reply frame access Chandrakanth Patil
2026-08-25 21:04 ` [PATCH v2 07/17] mpi3mr: Fix out-of-bounds sense buffer access Chandrakanth Patil
2026-08-25 16:08 ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 08/17] mpi3mr: Fix out-of-bounds bitmap access during device removal Chandrakanth Patil
2026-08-25 16:11 ` sashiko-bot
2026-08-25 21:04 ` Chandrakanth Patil [this message]
2026-08-25 16:20 ` [PATCH v2 09/17] mpi3mr: Fix target device reference leak in device removal handshake sashiko-bot
2026-08-25 21:04 ` [PATCH v2 10/17] mpi3mr: Fix out-of-bounds read in SAS topology change events Chandrakanth Patil
2026-08-25 17:15 ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 11/17] mpi3mr: Fix out-of-bounds read of event data Chandrakanth Patil
2026-08-25 16:06 ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 12/17] mpi3mr: Fix out-of-bounds phy array access on link change Chandrakanth Patil
2026-08-25 16:18 ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 13/17] mpi3mr: Fix buffer overflow in the BSG target device map Chandrakanth Patil
2026-08-25 16:07 ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 14/17] mpi3mr: Fix out-of-bounds read in PCIe topology change events Chandrakanth Patil
2026-08-25 16:10 ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 15/17] mpi3mr: zero out diagnostic buffer status memory Chandrakanth Patil
2026-08-25 21:04 ` [PATCH v2 16/17] mpi3mr: Fix use-after-free of the firmware event workqueue Chandrakanth Patil
2026-08-25 16:19 ` sashiko-bot
2026-08-25 21:04 ` [PATCH v2 17/17] mpi3mr: Fix NULL pointer dereference on PCI error recovery Chandrakanth Patil
2026-08-25 16:20 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260825210411.301535-10-chandrakanth.patil@broadcom.com \
--to=chandrakanth.patil@broadcom.com \
--cc=ipylypiv@google.com \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
--cc=ranjan.kumar@broadcom.com \
--cc=sathya.prakash@broadcom.com \
--cc=sumit.saxena@broadcom.com \
--cc=sweeti.vandure@broadcom.com \
--cc=vishakhavc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.