Re: [PATCH] scsi: fix refcount leaking for "tagset_refcnt"

[John Garry <john.g.garry@oracle.com>]

On 02/03/2026 20:36, junxiao.bi@oracle.com wrote:
>> At this point scsi_sysfs_device_initialize() has been called. Then if 
>> you check the comment in __scsi_remove_device():
>>
>> Paired with kref_get() in scsi_sysfs_device_initialize()*
>>
>> So I wonder why we don't call __scsi_remove_device() instead, which 
>> calls scsi_target_reap().
>>
>> Indeed, the current error handling in scsi_alloc_sdev() is odd - we 
>> only call __scsi_remove_device() for ->sdev_init() failure, but 
>> nothing happens between calling  ->sdev_init() and after 
>> scsi_sysfs_device_initialize() which means that at this point we 
>> should only now call __scsi_remove_device().
>>
>> * I think that should be scsi_sysfs_initialize() and has always been 
>> incorrect
> 
> Good catch. Thanks John. I will send a v2 with this:
> 
> diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
> index 60c06fa4ec32..c2f70de5c093 100644
> --- a/drivers/scsi/scsi_scan.c
> +++ b/drivers/scsi/scsi_scan.c
> @@ -361,9 +361,7 @@ static struct scsi_device *scsi_alloc_sdev(struct 
> scsi_target *starget,
>           * since we use this queue depth most of times.
>           */
>          if (scsi_realloc_sdev_budget_map(sdev, depth)) {
> -               put_device(&starget->dev);
> -               kfree(sdev);
> -               goto out;
> +               goto out_device_destroy;
>          }
> 
>          scsi_change_queue_depth(sdev, depth);

NP and sorry the late review. I think that Martin has already queued 
your v1 in his fixes branch...