Re: [PATCH] scsi: libsas: Handle expander discovery allocation failures

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The return value of `sas_rphy_add()` is ignored in `sas_ex_discover_expander()`, leading to incomplete sysfs registration and kernel warnings during device teardown on error.
--

commit 89b8642b2949851837e884780fd3067fcff48014
Author: Haoxiang Li <haoxiang_li2024@163.com>

scsi: libsas: Handle expander discovery allocation failures

This commit adds error handling for sas_port_alloc(), sas_port_add(), and
sas_expander_alloc() in sas_ex_discover_expander(). It unwinds the
allocated resources to prevent dereferencing uninitialized or NULL pointers.

> diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
> index f471ab464a78b..56c04c4ae8181 100644
> --- a/drivers/scsi/libsas/sas_expander.c
> +++ b/drivers/scsi/libsas/sas_expander.c

[ ... ]

> @@ -926,6 +928,9 @@ static struct domain_device *sas_ex_discover_expander(
>  		rphy = NULL;	/* shut gcc up */
>  		BUG();
>  	}
> +	if (!rphy)
> +		goto out_delete_port;
> +

[Severity: High]
This isn't a bug introduced by this patch, but further down in
sas_ex_discover_expander(), the return value of sas_rphy_add() is ignored:

	sas_init_dev(child);
	sas_fill_in_rphy(child, rphy);
	sas_rphy_add(rphy);

If sas_rphy_add() fails (for example, if device_add() fails under memory
pressure), the remote phy is not registered with sysfs.

When the device is eventually removed, or if discovery fails later in this
function, sas_rphy_delete() is unconditionally called:

	res = sas_discover_expander(child);
	if (res) {
		sas_rphy_delete(rphy);

Because sas_rphy_delete() calls device_del(), doing this on a device that
failed device_add() violates the driver core API.

Can this trigger a kernel WARN_ON or oops during device teardown? Could we
check the return value of sas_rphy_add() and handle the registration failure
along with these other resource allocation failures?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623112909.2172701-1-haoxiang_li2024@163.com?part=1