[PATCH] scsi: hpsa: Fix memory leak in hpsa_undo_allocations_after_kdump_soft_reset()

[PATCH] scsi: hpsa: Fix memory leak in hpsa_undo_allocations_after_kdump_soft_reset()

[Zilin Guan]

The h->reply_map is allocated in hpda_alloc_ctlr_info() via kcalloc().
If the controller reset fails during initialization in hpsa_init_one(),
hpsa_undo_allocations_after_kdump_soft_reset() is called to clean up
resources. However, this function frees the controller structure h but
fails to free h->reply_map, leading to a memory leak.

Fix this by freeing h->reply_map before freeing h in the cleanup function.

Fixes: 8b834bff1b73 ("scsi: hpsa: fix selection of reply queue")
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 drivers/scsi/hpsa.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 3654b12c5d5a..c35d7b097252 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -8212,6 +8212,8 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h)
 		h->monitor_ctlr_wq = NULL;
 	}
 
+	kfree(h->reply_map);		/* init_one 1 */
+	h->reply_map = NULL;		/* init_one 1 */
 	kfree(h);				/* init_one 1 */
 }
 
-- 
2.34.1

Re: [PATCH] scsi: hpsa: Fix memory leak in hpsa_undo_allocations_after_kdump_soft_reset()

[Markus Elfring]

…
> +++ b/drivers/scsi/hpsa.c
> @@ -8212,6 +8212,8 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h)
>  		h->monitor_ctlr_wq = NULL;
>  	}
>  
> +	kfree(h->reply_map);		/* init_one 1 */
> +	h->reply_map = NULL;		/* init_one 1 */

I find this reset statement redundant here.


>  	kfree(h);				/* init_one 1 */
>  }


Regards,
Markus

Re: [PATCH] scsi: hpsa: Fix memory leak in hpsa_undo_allocations_after_kdump_soft_reset()

[Zilin Guan]

On Tue, Dec 30, 2025 at 01:09:14PM +0100, Markus Elfring wrote:
> …
> > +++ b/drivers/scsi/hpsa.c
> > @@ -8212,6 +8212,8 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h)
> >  		h->monitor_ctlr_wq = NULL;
> >  	}
> >  
> > +	kfree(h->reply_map);		/* init_one 1 */
> > +	h->reply_map = NULL;		/* init_one 1 */
> 
> I find this reset statement redundant here.
> 
> 
> >  	kfree(h);				/* init_one 1 */
> >  }
> 
> 
> Regards,
> Markus

Hi Markus,

Thanks for the review.

I originally added the NULL assignment to maintain consistency with the 
existing code style in this function, but I agree it is redundant here.

I will remove it in v2.

Best regards,
Zilin Guan