[PATCH v2 0/3] scsi: lpfc: Fix multiple memory leaks in error paths

[PATCH v2 0/3] scsi: lpfc: Fix multiple memory leaks in error paths

[Zilin Guan]

This series fixes three independent memory leaks in the lpfc driver.
All of them occur in error handling paths where allocated memory
was not properly freed before returning.

These issues were identified during static analysis.

Signed-off-by: Zilin Guan <zilin@seu.edu.cn>

Changes in v2:
- Patch 1: Refactor error handling to use a goto label for cleanup.
- Patch 2: No changes.
- Patch 3: No changes.

Zilin Guan (3):
  scsi: lpfc: Fix memory leak in lpfc_config_port_post()
  scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
  scsi: lpfc: Fix memory leak in lpfc_cmpl_plogi_plogi_issue()

 drivers/scsi/lpfc/lpfc_init.c      | 21 +++++++++++----------
 drivers/scsi/lpfc/lpfc_nportdisc.c |  4 +++-
 2 files changed, 14 insertions(+), 11 deletions(-)

-- 
2.34.1

[PATCH v2 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Zilin Guan]

In lpfc_config_port_post(), pmb is allocated via mempool_alloc() but
is not freed when lpfc_readl() fails.

Instead of simply adding the missing free, refactor the error handling
to use a goto label. This unifies the cleanup logic and ensures pmb is
freed in all error paths.

Fixes: 9940b97bb30d ("[SCSI] lpfc 8.3.22: Add support for PCI Adapter Failure")
Suggested-by: Markus Elfring <Markus.Elfring@web.de>
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
v2:
- Refactor error handling to use a goto label for cleanup.

 drivers/scsi/lpfc/lpfc_init.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index b1460b16dd91..1390d2b5095d 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -511,8 +511,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 				"READ_CONFIG, mbxStatus x%x\n",
 				mb->mbxCommand, mb->mbxStatus);
 		phba->link_state = LPFC_HBA_ERROR;
-		mempool_free( pmb, phba->mbox_mem_pool);
-		return -EIO;
+		goto out_free;
 	}
 
 	/* Check if the port is disabled */
@@ -550,8 +549,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 	if (phba->intr_type == MSIX) {
 		rc = lpfc_config_msi(phba, pmb);
 		if (rc) {
-			mempool_free(pmb, phba->mbox_mem_pool);
-			return -EIO;
+			goto out_free;
 		}
 		rc = lpfc_sli_issue_mbox(phba, pmb, MBX_POLL);
 		if (rc != MBX_SUCCESS) {
@@ -560,8 +558,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 					"failed, mbxCmd x%x, mbxStatus x%x\n",
 					pmb->u.mb.mbxCommand,
 					pmb->u.mb.mbxStatus);
-			mempool_free(pmb, phba->mbox_mem_pool);
-			return -EIO;
+			goto out_free;
 		}
 	}
 
@@ -572,7 +569,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 	/* Enable appropriate host interrupts */
 	if (lpfc_readl(phba->HCregaddr, &status)) {
 		spin_unlock_irq(&phba->hbalock);
-		return -EIO;
+		goto out_free;
 	}
 	status |= HC_MBINT_ENA | HC_ERINT_ENA | HC_LAINT_ENA;
 	if (psli->num_rings > 0)
@@ -616,9 +613,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 			lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
 					"2599 Adapter failed to issue DOWN_LINK"
 					" mbox command rc 0x%x\n", rc);
-
-			mempool_free(pmb, phba->mbox_mem_pool);
-			return -EIO;
+			goto out_free;
 		}
 	} else if (phba->cfg_suppress_link_up == LPFC_INITIALIZE_LINK) {
 		mempool_free(pmb, phba->mbox_mem_pool);
@@ -666,6 +661,10 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 	}
 
 	return 0;
+
+out_free:
+	mempool_free(pmb, phba->mbox_mem_pool);
+	return -EIO;
 }
 
 /**
-- 
2.34.1

Re: [PATCH v2 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Markus Elfring]

…
> +++ b/drivers/scsi/lpfc/lpfc_init.c
…
> @@ -550,8 +549,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
>  	if (phba->intr_type == MSIX) {
>  		rc = lpfc_config_msi(phba, pmb);
>  		if (rc) {
> -			mempool_free(pmb, phba->mbox_mem_pool);
> -			return -EIO;
> +			goto out_free;
>  		}

You may omit curly brackets here.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/coding-style.rst?h=v6.19-rc3#n197


>  		rc = lpfc_sli_issue_mbox(phba, pmb, MBX_POLL);
>  		if (rc != MBX_SUCCESS) {
…


Regards,
Markus

Re: [PATCH v2 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Zilin Guan]

On Tue, Dec 30, 2025 at 05:01:32PM+0100, Markus Elfring wrote:
> …
> > +++ b/drivers/scsi/lpfc/lpfc_init.c
> …
> > @@ -550,8 +549,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
> >  	if (phba->intr_type == MSIX) {
> >  		rc = lpfc_config_msi(phba, pmb);
> >  		if (rc) {
> > -			mempool_free(pmb, phba->mbox_mem_pool);
> > -			return -EIO;
> > +			goto out_free;
> >  		}
> 
> You may omit curly brackets here.
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/coding-style.rst?h=v6.19-rc3#n197

Hi Markus,

Thanks for the review.

I missed this one during the refactoring. I will remove the unnecessary 
braces in v3.

Best regards,
Zilin Guan

[PATCH v2 2/3] scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

[Zilin Guan]

In lpfc_sli4_driver_resource_setup(), mboxq is allocated via
mempool_alloc() but is not freed when the allocation of
phba->lpfc_sg_dma_buf_pool or phba->lpfc_cmd_rsp_buf_pool fails.

Fix this by adding mempool_free() in the error paths.

Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.")
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 drivers/scsi/lpfc/lpfc_init.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 1390d2b5095d..54a8d290c2e1 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -8295,6 +8295,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
 					i, 0);
 	if (!phba->lpfc_sg_dma_buf_pool) {
 		rc = -ENOMEM;
+		mempool_free(mboxq, phba->mbox_mem_pool);
 		goto out_free_bsmbx;
 	}
 
@@ -8306,6 +8307,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
 					i, 0);
 	if (!phba->lpfc_cmd_rsp_buf_pool) {
 		rc = -ENOMEM;
+		mempool_free(mboxq, phba->mbox_mem_pool);
 		goto out_free_sg_dma_buf;
 	}
 
-- 
2.34.1

[PATCH v2 3/3] scsi: lpfc: Fix memory leak in lpfc_cmpl_plogi_plogi_issue()

[Zilin Guan]

In lpfc_cmpl_plogi_plogi_issue(), mbox is allocated via
mempool_alloc() and initialized. However, if lpfc_nlp_get() fails,
the mbox and its resources are not freed.

Fix this by using lpfc_mbox_rsrc_cleanup() to free the mailbox and
its associated resources.

Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 8240d59f4120..e81640223276 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1505,8 +1505,10 @@ lpfc_cmpl_plogi_plogi_issue(struct lpfc_vport *vport,
 		}
 
 		mbox->ctx_ndlp = lpfc_nlp_get(ndlp);
-		if (!mbox->ctx_ndlp)
+		if (!mbox->ctx_ndlp) {
+			lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
 			goto out;
+		}
 
 		mbox->vport = vport;
 		if (lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT)
-- 
2.34.1