[PATCH AUTOSEL 6.16-6.15] scsi: pm80xx: Free allocated tags after failure

[Sasha Levin <sashal@kernel.org>]

From: Francisco Gutierrez <frankramirez@google.com>

[ Upstream commit 258a0a19621793b811356fc9d1849f950629d669 ]

This change frees resources after an error is detected.

Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
Link: https://lore.kernel.org/r/20250617210443.989058-1-frankramirez@google.com
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

**Backport Status: YES**

This commit should be backported to stable kernel trees for the
following reasons:

## Bug Fix Analysis

1. **Clear Resource Leak Bug**: The commit fixes a resource leak where
   tags allocated via `pm8001_tag_alloc()` are not freed when
   `pm8001_mpi_build_cmd()` fails. Looking at the code:
   - In `pm80xx_chip_phy_start_req()` at line 4652-4656, a tag is
     allocated
   - If `pm8001_mpi_build_cmd()` fails (returns error), the function
     returns directly without freeing the allocated tag
   - The same pattern exists in `pm80xx_chip_phy_stop_req()`

2. **Actual Runtime Impact**: The `pm8001_mpi_build_cmd()` function can
   fail with `-ENOMEM` when no free MPI buffers are available (as shown
   in the function implementation). This is a realistic failure scenario
   under memory pressure or high I/O load, making this a real-world bug.

3. **Resource Exhaustion Risk**: The driver uses a limited tag pool
   (PM8001_RESERVE_SLOT tags). Each leaked tag reduces the available
   pool, potentially leading to:
   - Tag exhaustion over time
   - Inability to issue new PHY start/stop commands
   - Degraded SCSI controller functionality

4. **Consistent Pattern Fix**: The codebase already has established
   patterns for properly freeing tags on error paths, as evidenced by:
   - Multiple existing instances where `pm8001_tag_free()` is called
     after `pm8001_mpi_build_cmd()` failures
   - Previous similar fix in commit c13e73317458 for tag leaks in
     `OPC_INB_SET_CONTROLLER_CONFIG` command

5. **Small and Contained Fix**: The changes are minimal (4 lines added
   in total), localized to two functions, and follow existing error
   handling patterns in the driver. This minimizes regression risk.

6. **No New Features or Architecture Changes**: The commit purely fixes
   a resource leak without introducing new functionality or changing
   driver behavior.

7. **Maintainer Acknowledgment**: The fix is acknowledged by the
   subsystem maintainer (Jack Wang), indicating it's a legitimate issue
   that needed addressing.

The fix aligns perfectly with stable kernel criteria - it's a clear bug
fix for a resource leak that can impact system stability over time, with
minimal code changes and low regression risk.

 drivers/scsi/pm8001/pm80xx_hwi.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 5b373c53c036..c4074f062d93 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -4677,8 +4677,12 @@ pm80xx_chip_phy_start_req(struct pm8001_hba_info *pm8001_ha, u8 phy_id)
 		&pm8001_ha->phy[phy_id].dev_sas_addr, SAS_ADDR_SIZE);
 	payload.sas_identify.phy_id = phy_id;
 
-	return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
+	ret = pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
 				    sizeof(payload), 0);
+	if (ret < 0)
+		pm8001_tag_free(pm8001_ha, tag);
+
+	return ret;
 }
 
 /**
@@ -4704,8 +4708,12 @@ static int pm80xx_chip_phy_stop_req(struct pm8001_hba_info *pm8001_ha,
 	payload.tag = cpu_to_le32(tag);
 	payload.phy_id = cpu_to_le32(phy_id);
 
-	return pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
+	ret = pm8001_mpi_build_cmd(pm8001_ha, 0, opcode, &payload,
 				    sizeof(payload), 0);
+	if (ret < 0)
+		pm8001_tag_free(pm8001_ha, tag);
+
+	return ret;
 }
 
 /*
-- 
2.39.5