[PATCH 0/3] scsi: lpfc: Fix multiple memory leaks in error paths

[PATCH 0/3] scsi: lpfc: Fix multiple memory leaks in error paths

[Zilin Guan]

This series fixes three independent memory leaks in the lpfc driver.
All of them occur in error handling paths where allocated memory
was not properly freed before returning.

These issues were identified during static analysis.

Zilin Guan (3):
  scsi: lpfc: Fix memory leak in lpfc_config_port_post()
  scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
  scsi: lpfc: Fix memory leak in lpfc_cmpl_plogi_plogi_issue()

 drivers/scsi/lpfc/lpfc_init.c      | 3 +++
 drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

-- 
2.34.1

[PATCH 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Zilin Guan]

In lpfc_config_port_post(), pmb is allocated via mempool_alloc() but
is not freed when lpfc_readl() fails.

Fix this by adding mempool_free() in the error path.

Fixes: 9940b97bb30d ("[SCSI] lpfc 8.3.22: Add support for PCI Adapter Failure")
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 drivers/scsi/lpfc/lpfc_init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index b1460b16dd91..bc2e55f6a50f 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -572,6 +572,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 	/* Enable appropriate host interrupts */
 	if (lpfc_readl(phba->HCregaddr, &status)) {
 		spin_unlock_irq(&phba->hbalock);
+		mempool_free(pmb, phba->mbox_mem_pool);
 		return -EIO;
 	}
 	status |= HC_MBINT_ENA | HC_ERINT_ENA | HC_LAINT_ENA;
-- 
2.34.1

[PATCH 2/3] scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()

[Zilin Guan]

In lpfc_sli4_driver_resource_setup(), mboxq is allocated via
mempool_alloc() but is not freed when the allocation of
phba->lpfc_sg_dma_buf_pool or phba->lpfc_cmd_rsp_buf_pool fails.

Fix this by adding mempool_free() in the error paths.

Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.")
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 drivers/scsi/lpfc/lpfc_init.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index bc2e55f6a50f..760e38b778fb 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -8297,6 +8297,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
 					i, 0);
 	if (!phba->lpfc_sg_dma_buf_pool) {
 		rc = -ENOMEM;
+		mempool_free(mboxq, phba->mbox_mem_pool);
 		goto out_free_bsmbx;
 	}
 
@@ -8308,6 +8309,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
 					i, 0);
 	if (!phba->lpfc_cmd_rsp_buf_pool) {
 		rc = -ENOMEM;
+		mempool_free(mboxq, phba->mbox_mem_pool);
 		goto out_free_sg_dma_buf;
 	}
 
-- 
2.34.1

[PATCH 3/3] scsi: lpfc: Fix memory leak in lpfc_cmpl_plogi_plogi_issue()

[Zilin Guan]

In lpfc_cmpl_plogi_plogi_issue(), mbox is allocated via
mempool_alloc() and initialized. However, if lpfc_nlp_get() fails,
the mbox and its resources are not freed.

Fix this by using lpfc_mbox_rsrc_cleanup() to free the mailbox and
its associated resources.

Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn>
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 drivers/scsi/lpfc/lpfc_nportdisc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 8240d59f4120..e81640223276 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1505,8 +1505,10 @@ lpfc_cmpl_plogi_plogi_issue(struct lpfc_vport *vport,
 		}
 
 		mbox->ctx_ndlp = lpfc_nlp_get(ndlp);
-		if (!mbox->ctx_ndlp)
+		if (!mbox->ctx_ndlp) {
+			lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
 			goto out;
+		}
 
 		mbox->vport = vport;
 		if (lpfc_sli_issue_mbox(phba, mbox, MBX_NOWAIT)
-- 
2.34.1

Re: [PATCH 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Markus Elfring]

…
> Fix this by adding mempool_free() in the error path.

Please avoid duplicate source code here.
https://elixir.bootlin.com/linux/v6.19-rc2/source/drivers/scsi/lpfc/lpfc_init.c#L563-L564


See also:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc3#n262

Regards,
Markus

Re: [PATCH 0/3] scsi: lpfc: Fix multiple memory leaks in error paths

[Justin Tee]

Hi Zilin,

For this patch set, please see and attend to Markus’ comments.

Regards,
Justin

Re: [PATCH 0/3] scsi: lpfc: Fix multiple memory leaks in error paths

[Zilin Guan]

On Mon, Dec 29, 2025 at 06:04:01PM -0800, Justin Tee wrote:
> Hi Zilin,
> 
> For this patch set, please see and attend to Markus’ comments.
> 
> Regards,
> Justin

Hi Justin,

Thanks for the reminder.

It seems Markus' email was accidentally filtered as spam by my mail 
server, which is why I missed it. I have retrieved it now and will 
address his comments shortly.

Best regards,
Zilin Guan

Re: [PATCH 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Zilin Guan]

On Mon, Dec 29, 2025 at 10:09:04AM +0100, Markus Elfring wrote:
> …
> > Fix this by adding mempool_free() in the error path.
> 
> Please avoid duplicate source code here.
> https://elixir.bootlin.com/linux/v6.19-rc2/source/drivers/scsi/lpfc/lpfc_init.c#L563-L564

Thanks for pointing this out. I will use a goto label to unify the error 
handling logic and avoid code duplication in v2.

> See also:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc3#n262
> 
> Regards,
> Markus

Regarding the stable kernel rules, do you consider this bug severe enough 
to warrant a Cc: stable tag? Since this error path is unlikely to be 
triggered during normal operation and the leak is small, I didn't think 
it was critical enough to bother the stable maintainers.

Thanks,
Zilin Guan

Re: [1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Markus Elfring]

>> See also:
>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc3#n262
…
> Regarding the stable kernel rules, do you consider this bug severe enough 
> to warrant a Cc: stable tag?

I suggest to take another look at information from previous discussions on
severity filters.


>                              Since this error path is unlikely to be 
> triggered during normal operation and the leak is small,

It seems that basic data processing was not hindered so far by the affected
function implementation.


>                                                          I didn't think 
> it was critical enough to bother the stable maintainers.

The tag “Fixes” is also an indication for related development considerations,
isn't it?

Regards,
Markus

Re: [1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Zilin Guan]

> I suggest to take another look at information from previous discussions on
> severity filters.
> ...
> It seems that basic data processing was not hindered so far by the affected
> function implementation.
> ...
> The tag “Fixes” is also an indication for related development considerations,
> isn't it?

Thanks for the clarification.

I agree that the "Fixes" tag provides sufficient context for tracking. 
Given that the bug does not impact basic functionality, I will rely 
on the "Fixes" tag and leave the backporting decision to the stable 
maintainers' discretion, rather than explicitly adding the "Cc: stable".

I will send out v2 with the code refactoring (using goto) shortly.

Regards,
Zilin Guan

Re: [PATCH 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Dan Carpenter]

On Tue, Dec 30, 2025 at 06:20:08AM +0000, Zilin Guan wrote:
> On Mon, Dec 29, 2025 at 10:09:04AM +0100, Markus Elfring wrote:
> > …
> > > Fix this by adding mempool_free() in the error path.
> > 
> > Please avoid duplicate source code here.
> > https://elixir.bootlin.com/linux/v6.19-rc2/source/drivers/scsi/lpfc/lpfc_init.c#L563-L564
> 
> Thanks for pointing this out. I will use a goto label to unify the error 
> handling logic and avoid code duplication in v2.
> 
> > See also:
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc3#n262
> > 
> > Regards,
> > Markus
> 
> Regarding the stable kernel rules, do you consider this bug severe enough 
> to warrant a Cc: stable tag? Since this error path is unlikely to be 
> triggered during normal operation and the leak is small, I didn't think 
> it was critical enough to bother the stable maintainers.

I don't agree with either of Markus's review comments.  People have
asked him to stop reviewing code or at least to stick to pointing out
bugs or complaining about style and grammar issues but he doesn't
listen.

https://lore.kernel.org/all/2025121108-armless-earthling-7a6f@gregkh/

regards,
dan carpenter

Re: [PATCH 0/3] scsi: lpfc: Fix multiple memory leaks in error paths

[Dan Carpenter]

On Mon, Dec 29, 2025 at 06:04:01PM -0800, Justin Tee wrote:
> Hi Zilin,
> 
> For this patch set, please see and attend to Markus’ comments.

You should provide a link to lore because a lot of people have blocked
Markus so we don't see it in our inboxes.

regards,
dan carpenter

Re: [PATCH 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Dan Carpenter]

On Mon, Jan 05, 2026 at 12:53:40PM +0300, Dan Carpenter wrote:
> On Tue, Dec 30, 2025 at 06:20:08AM +0000, Zilin Guan wrote:
> > On Mon, Dec 29, 2025 at 10:09:04AM +0100, Markus Elfring wrote:
> > > …
> > > > Fix this by adding mempool_free() in the error path.
> > > 
> > > Please avoid duplicate source code here.
> > > https://elixir.bootlin.com/linux/v6.19-rc2/source/drivers/scsi/lpfc/lpfc_init.c#L563-L564
> > 
> > Thanks for pointing this out. I will use a goto label to unify the error 
> > handling logic and avoid code duplication in v2.
> > 
> > > See also:
> > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc3#n262
> > > 
> > > Regards,
> > > Markus
> > 
> > Regarding the stable kernel rules, do you consider this bug severe enough 
> > to warrant a Cc: stable tag? Since this error path is unlikely to be 
> > triggered during normal operation and the leak is small, I didn't think 
> > it was critical enough to bother the stable maintainers.
> 
> I don't agree with either of Markus's review comments.  People have
> asked him to stop reviewing code or at least to stick to pointing out
> bugs or complaining about style and grammar issues but he doesn't
> listen.

I meant "or at least stop complaining about style and grammar issues".

regards,
dan carpenter

Re: [1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

[Markus Elfring]

> I meant "or at least stop complaining about style and grammar issues".

Do any other contributors occasionally get also into the mood to point similar
adjustment opportunities out?

Regards,
Markus