[PATCH] scsi: mpt3sas: Fix sas_device reference leak in mpt3sas_transport_port_add()

[PATCH] scsi: mpt3sas: Fix sas_device reference leak in mpt3sas_transport_port_add()

[Wentao Liang]

mpt3sas_get_sdev_by_addr() takes a reference on the sas device for SAS
end devices, but it is only dropped on the success path. When the port
cannot be created, for example because the parent device is missing,
sas_port_add() or sas_rphy_add() fails, the function bails out to
out_delete_port/out_fail without releasing the reference.

Drop the reference on the out_fail path.

Fixes: 7d310f241001 ("scsi: mpt3sas: Get device objects using sas_address & portID")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index e74a526efa8d..f831d4823503 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -869,6 +869,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
 	list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,
 	    port_siblings)
 		list_del(&mpt3sas_phy->port_siblings);
+	if (sas_device)
+		sas_device_put(sas_device);
 	kfree(mpt3sas_port);
 	return NULL;
 }
-- 
2.34.1

Re: [PATCH] scsi: mpt3sas: Fix sas_device reference leak in mpt3sas_transport_port_add()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Low] mpt3sas: build failure due to undeclared sas_device_put()
- [Low] mpt3sas: dead code in out_fail path as sas_device is always NULL
--

commit 488cd1fc5aeb3fa9ed5496cf3747de1d6edef41f
Author: Wentao Liang <vulab@iscas.ac.cn>

scsi: mpt3sas: Fix sas_device reference leak in mpt3sas_transport_port_add()

This patch attempts to fix a reference leak in the error path of
mpt3sas_transport_port_add() by dropping the reference to sas_device. It
adds a check and a call to sas_device_put() in the out_fail label.

Cc: stable@vger.kernel.org

> diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
> --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
> +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
> @@ -777,6 +777,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
>  	list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,
>  	    port_siblings)
>  		list_del(&mpt3sas_phy->port_siblings);
> +	if (sas_device)
> +		sas_device_put(sas_device);

[Severity: Low]
Does this compile against the current mpt3sas driver? It appears
sas_device_put() is not declared for mpt3sas in this kernel baseline, and
the mpt3sas version of struct _sas_device lacks a reference count. Is this
perhaps a flawed backport or ported from a different driver version?

[Severity: Low]
Can this cleanup branch ever execute? Looking at
mpt3sas_transport_port_add(), when the code jumps to out_fail before
sas_device is assigned, it is NULL.

The only assignment to sas_device is immediately followed by a check that
jumps to out_fail only if sas_device is already NULL:

	sas_device = mpt3sas_scsih_sas_device_find_by_sas_address(ioc,
			    mpt3sas_port->remote_identify.sas_address);
	if (!sas_device) {
		dfailprintk(ioc, printk(MPT3SAS_FMT
			"failure at %s:%d/%s()!\n",
			ioc->name, __FILE__, __LINE__, __func__));
		goto out_fail;
	}

Subsequent code, including the sas_rphy_add() call, does not jump to
out_fail on error. This makes the if (sas_device) check mathematically
guaranteed to be false whenever out_fail is executed.

>  	kfree(mpt3sas_port);
>  	return NULL;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917151720.2158664-1-vulab@iscas.ac.cn?part=1