Re: [PATCH] scsi: aic94xx: Free the IRQ before killing the completion tasklet

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: aic94xx: memory leak of sas_phys and sas_ports arrays on probe error
--

commit 06cb328e08d3b300d95f57379c0e6e1c9182cebb
Author: Myeonghun Pak <mhun512@gmail.com>

scsi: aic94xx: Free the IRQ before killing the completion tasklet

This commit changes the teardown order in the aic94xx driver by moving
free_irq() ahead of tasklet_kill(). This ensures that the last possible
producer is joined before killing the completion tasklet in the device
removal and probe error paths.

> diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
> --- a/drivers/scsi/aic94xx/aic94xx_init.c
> +++ b/drivers/scsi/aic94xx/aic94xx_init.c
> @@ -810,6 +810,7 @@ static int asd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
>  Err_escbs:
>  	asd_disable_ints(asd_ha);
>  	free_irq(dev->irq, asd_ha);
> +	tasklet_kill(&asd_ha->seq.dl_tasklet);
>  Err_irq:

[Severity: Medium]
Does this error handling path leak the sas_phys and sas_ports arrays?

If sas_register_ha() fails in asd_register_sas_ha(), those arrays are
dynamically allocated but do not appear to be freed before returning an
error:

drivers/scsi/aic94xx/aic94xx_init.c:asd_register_sas_ha() {
        struct asd_sas_phy   **sas_phys =
                kzalloc_objs(*sas_phys, ASD_MAX_PHYS);
        struct asd_sas_port  **sas_ports =
                kzalloc_objs(*sas_ports, ASD_MAX_PHYS);
        ...
        return sas_register_ha(&asd_ha->sas_ha);
}

The asd_pci_probe() function propagates this failure by jumping to
Err_reg_sas, which falls through this code block to eventually free asd_ha.
Could we be missing a kfree() for asd_ha->sas_ha.sas_phy and
asd_ha->sas_ha.sas_port before freeing the main structure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261011151621.b9b17c998453-1-mhun512@gmail.com?part=1