Re: [PATCH] scsi: mpt3sas: Fix sas_device reference leak in mpt3sas_transport_port_add()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Low] mpt3sas: build failure due to undeclared sas_device_put()
- [Low] mpt3sas: dead code in out_fail path as sas_device is always NULL
--

commit 488cd1fc5aeb3fa9ed5496cf3747de1d6edef41f
Author: Wentao Liang <vulab@iscas.ac.cn>

scsi: mpt3sas: Fix sas_device reference leak in mpt3sas_transport_port_add()

This patch attempts to fix a reference leak in the error path of
mpt3sas_transport_port_add() by dropping the reference to sas_device. It
adds a check and a call to sas_device_put() in the out_fail label.

Cc: stable@vger.kernel.org

> diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
> --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
> +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
> @@ -777,6 +777,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
>  	list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,
>  	    port_siblings)
>  		list_del(&mpt3sas_phy->port_siblings);
> +	if (sas_device)
> +		sas_device_put(sas_device);

[Severity: Low]
Does this compile against the current mpt3sas driver? It appears
sas_device_put() is not declared for mpt3sas in this kernel baseline, and
the mpt3sas version of struct _sas_device lacks a reference count. Is this
perhaps a flawed backport or ported from a different driver version?

[Severity: Low]
Can this cleanup branch ever execute? Looking at
mpt3sas_transport_port_add(), when the code jumps to out_fail before
sas_device is assigned, it is NULL.

The only assignment to sas_device is immediately followed by a check that
jumps to out_fail only if sas_device is already NULL:

	sas_device = mpt3sas_scsih_sas_device_find_by_sas_address(ioc,
			    mpt3sas_port->remote_identify.sas_address);
	if (!sas_device) {
		dfailprintk(ioc, printk(MPT3SAS_FMT
			"failure at %s:%d/%s()!\n",
			ioc->name, __FILE__, __LINE__, __func__));
		goto out_fail;
	}

Subsequent code, including the sas_rphy_add() call, does not jump to
out_fail on error. This makes the if (sas_device) check mathematically
guaranteed to be false whenever out_fail is executed.

>  	kfree(mpt3sas_port);
>  	return NULL;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917151720.2158664-1-vulab@iscas.ac.cn?part=1