[PATCH] scsi: qla2xxx: fix refcount leak in qla24xx_async_prli()

[PATCH] scsi: qla2xxx: fix refcount leak in qla24xx_async_prli()

[WenTao Liang]

When qla24xx_async_prli() fails to start an SP, it jumps to the
done_free_sp error path and releases only the command kref via
kref_put.  However, the vha reference count obtained earlier by
qla2x00_get_sp() through qla_vha_mark_busy() is never released on
this path, leading to a permanent leak of vha->vref_count.

Fix the leak by explicitly calling QLA_VHA_MARK_NOT_BUSY(vha) in
the error path before returning.

Cc: stable@vger.kernel.org
Fixes: a5d42f4cffa5 ("scsi: qla2xxx: Add FC-NVMe port discovery and PRLI handling")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/scsi/qla2xxx/qla_init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index e746c9274cde..8dd717dfcc14 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1352,6 +1352,7 @@ qla24xx_async_prli(struct scsi_qla_host *vha, fc_port_t *fcport)
 done_free_sp:
 	/* ref: INIT */
 	kref_put(&sp->cmd_kref, qla2x00_sp_release);
+	QLA_VHA_MARK_NOT_BUSY(vha);
 	fcport->flags &= ~FCF_ASYNC_SENT;
 	return rval;
 }
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] scsi: qla2xxx: fix refcount leak in qla24xx_async_prli()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Double-decrement (underflow) of `vha->vref_count` on the error path of `qla24xx_async_prli()`.
--

commit 96156510fc7447ae3d281225a3388973efa74abd
Author: WenTao Liang <vulab@iscas.ac.cn>

scsi: qla2xxx: fix refcount leak in qla24xx_async_prli()

This commit attempts to fix a vha refcount leak in the error path of
qla24xx_async_prli by explicitly calling QLA_VHA_MARK_NOT_BUSY(vha) after
releasing the command kref.

> diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
> index e746c9274cded..8dd717dfcc144 100644
> --- a/drivers/scsi/qla2xxx/qla_init.c
> +++ b/drivers/scsi/qla2xxx/qla_init.c
> @@ -1352,6 +1352,7 @@ qla24xx_async_prli(struct scsi_qla_host *vha, fc_port_t *fcport)
>  done_free_sp:
>  	/* ref: INIT */
>  	kref_put(&sp->cmd_kref, qla2x00_sp_release);
> +	QLA_VHA_MARK_NOT_BUSY(vha);

[Severity: High]
Does this result in a double-decrement of the vha refcount?

Looking at the release callback chain, kref_put() calls qla2x00_sp_release(),
which unconditionally calls sp->free(sp).

During initialization, qla2x00_init_async_sp() sets the free callback to
qla2x00_sp_free(), which then calls qla2x00_rel_sp(). Finally,
qla2x00_rel_sp() calls QLA_VHA_MARK_NOT_BUSY(sp->vha).

If the refcount is already decremented by the kref_put() callback chain:

kref_put()
  qla2x00_sp_release()
    qla2x00_sp_free()
      qla2x00_rel_sp()
        QLA_VHA_MARK_NOT_BUSY()

Does adding an explicit call here cause an underflow?

>  	fcport->flags &= ~FCF_ASYNC_SENT;
>  	return rval;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611110919.74911-1-vulab@iscas.ac.cn?part=1