[PATCH] nvme-fc: fix reference leak in nvme_fc_nvme_discovery_store()

[PATCH] nvme-fc: fix reference leak in nvme_fc_nvme_discovery_store()

[Martin George]

nvme_fc_nvme_discovery_store() takes an lport and rport reference before
checking whether the rport is already queued on the local discovery
list. On the retry path (goto restart), rports that were queued in an
earlier pass are skipped by the list_empty() check, but the references
taken for them in the current pass are never dropped, leaking one lport
and one rport reference per retry.

Check list_empty() first and only take references for rports that are
actually added to the local discovery list.

Signed-off-by: Martin George <marting@netapp.com>
---
 drivers/nvme/host/fc.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 48454cb7a0fc..03f6fffc9574 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3778,6 +3778,9 @@ static ssize_t nvme_fc_nvme_discovery_store(struct device *dev,
 restart:
 	list_for_each_entry(lport, &nvme_fc_lport_list, port_list) {
 		list_for_each_entry(rport, &lport->endp_list, endp_list) {
+			/* skip rports already queued for discovery */
+			if (!list_empty(&rport->disc_list))
+				continue;
 			if (!nvme_fc_lport_get(lport))
 				continue;
 			if (!nvme_fc_rport_get(rport)) {
@@ -3799,9 +3802,7 @@ static ssize_t nvme_fc_nvme_discovery_store(struct device *dev,
 				       "failures\n");
 				goto process_local_list;
 			}
-			if (list_empty(&rport->disc_list))
-				list_add_tail(&rport->disc_list,
-					      &local_disc_list);
+			list_add_tail(&rport->disc_list, &local_disc_list);
 		}
 	}
 
-- 
2.43.0

Re: [PATCH] nvme-fc: fix reference leak in nvme_fc_nvme_discovery_store()

[Laurence Oberman]

On Fri, 2026-10-23 at 19:30 +0530, Martin George wrote:
> nvme_fc_nvme_discovery_store() takes an lport and rport reference
> before
> checking whether the rport is already queued on the local discovery
> list. On the retry path (goto restart), rports that were queued in an
> earlier pass are skipped by the list_empty() check, but the
> references
> taken for them in the current pass are never dropped, leaking one
> lport
> and one rport reference per retry.
> 
> Check list_empty() first and only take references for rports that are
> actually added to the local discovery list.
> 
> Signed-off-by: Martin George <marting@netapp.com>
> ---
>  drivers/nvme/host/fc.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
> index 48454cb7a0fc..03f6fffc9574 100644
> --- a/drivers/nvme/host/fc.c
> +++ b/drivers/nvme/host/fc.c
> @@ -3778,6 +3778,9 @@ static ssize_t
> nvme_fc_nvme_discovery_store(struct device *dev,
>  restart:
>  	list_for_each_entry(lport, &nvme_fc_lport_list, port_list) {
>  		list_for_each_entry(rport, &lport->endp_list,
> endp_list) {
> +			/* skip rports already queued for discovery
> */
> +			if (!list_empty(&rport->disc_list))
> +				continue;
>  			if (!nvme_fc_lport_get(lport))
>  				continue;
>  			if (!nvme_fc_rport_get(rport)) {
> @@ -3799,9 +3802,7 @@ static ssize_t
> nvme_fc_nvme_discovery_store(struct device *dev,
>  				       "failures\n");
>  				goto process_local_list;
>  			}
> -			if (list_empty(&rport->disc_list))
> -				list_add_tail(&rport->disc_list,
> -					      &local_disc_list);
> +			list_add_tail(&rport->disc_list,
> &local_disc_list);
>  		}
>  	}
> 
>  
This looks good to me.
Reviewed-by: Laurence Oberman <loberman@redhat.com>

Re: [PATCH] nvme-fc: fix reference leak in nvme_fc_nvme_discovery_store()

[Keith Busch]

On Fri, Oct 23, 2026 at 07:30:57PM +0530, Martin George wrote:
> nvme_fc_nvme_discovery_store() takes an lport and rport reference before
> checking whether the rport is already queued on the local discovery
> list. On the retry path (goto restart), rports that were queued in an
> earlier pass are skipped by the list_empty() check, but the references
> taken for them in the current pass are never dropped, leaking one lport
> and one rport reference per retry.
> 
> Check list_empty() first and only take references for rports that are
> actually added to the local discovery list.

Thanks, applied to nvme-7.4.