Re: [PATCH v2 08/10] mpi3mr: Fix SAS port allocation and registration error handling

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Double free of `rphy` on `sas_rphy_add` failure path.
--

--- Patch [8]: [PATCH v2 08/10] mpi3mr: Fix SAS port allocation and registration error handling ---
commit e4e396e6a24625afa6491df657cf719648b0c2a2
Author: Ranjan Kumar <ranjan.kumar@broadcom.com>

mpi3mr: Fix SAS port allocation and registration error handling

This commit adds NULL checks for SAS port and rphy allocations to prevent
potential NULL pointer dereferences. It also introduces cleanup logic on
the error paths to prevent memory leaks when registration fails.

Closes: https://sashiko.dev/#/patchset/20260626114109.43685-1-ranjan.kumar@broadcom.com?part=8

> diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c
> index 240f67a8e2e3b..b51edbb921ebb 100644
> --- a/drivers/scsi/mpi3mr/mpi3mr_transport.c
> +++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c

[ ... ]

> @@ -1463,6 +1481,9 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc,
>  	if ((sas_rphy_add(rphy))) {
>  		ioc_err(mrioc, "failure at %s:%d/%s()!\n",
>  		    __FILE__, __LINE__, __func__);
> +		sas_port_delete(port);
> +		sas_rphy_free(rphy);

[Severity: High]
Does this code introduce a double free?  When sas_rphy_add() fails, port->rphy
still points to the newly allocated rphy object. 

Calling sas_port_delete(port) automatically invokes sas_rphy_delete(port->rphy):

drivers/scsi/scsi_transport_sas.c:sas_port_delete() {
    ...
	if (port->rphy) {
		sas_rphy_delete(port->rphy);
		port->rphy = NULL;
	}
    ...
}

Since sas_rphy_delete() will free the rphy, executing sas_rphy_free(rphy)
immediately afterward appears to operate on an already-freed pointer.

> +		goto out_fail;
>  	}
>  	if (mr_sas_port->remote_identify.device_type == SAS_END_DEVICE) {
>  		tgtdev->dev_spec.sas_sata_inf.pend_sas_rphy_add = 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708183305.244485-1-ranjan.kumar@broadcom.com?part=8