Re: [PATCH] scsi: elx: libefc: fix resources leak in efcport_init() error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: elx: memory leak of efc struct in efct_efclib_config() error path
--

commit f7137ee0f9986ee6fc40d031e1433afbe8aa395a
Author: Haotian Zhang <vulab@iscas.ac.cn>

scsi: elx: libefc: fix resources leak in efcport_init() error path
    
efcport_init() creates efc->node_pool and efc->node_dma_pool before
allocating efc->els_io_pool. When the latter allocation fails it returns
-ENOMEM without releasing the node dma pool or the node pool, leaking
both.

> diff --git a/drivers/scsi/elx/libefc/efclib.c b/drivers/scsi/elx/libefc/efclib.c
> index dd3e3d0a47614..ceec0e2a0266a 100644
> --- a/drivers/scsi/elx/libefc/efclib.c
> +++ b/drivers/scsi/elx/libefc/efclib.c
> @@ -50,6 +50,8 @@ int efcport_init(struct efc *efc)
>  						sizeof(struct efc_els_io_req));
>  	if (!efc->els_io_pool) {
>  		efc_log_err(efc, "Can't allocate els io pool\n");
> +		dma_pool_destroy(efc->node_dma_pool);
> +		mempool_destroy(efc->node_pool);
>  		return -ENOMEM;

[Severity: Medium]
Does returning an error here result in leaking the efc struct itself?

In drivers/scsi/elx/efct/efct_driver.c:efct_efclib_config(), the efc struct
is dynamically allocated and attached to efct->efcport:

	efc = kzalloc_obj(*efc);
	if (!efc)
		return -ENOMEM;

	efct->efcport = efc;

When efcport_init() fails, it returns the error without freeing the efc
struct:

	rc = efcport_init(efc);
	if (rc)
		efc_log_err(efc, "efcport_init failed\n");

	return rc;

The error handler in efct_device_attach() also skips freeing efct->efcport
or calling efcport_destroy():

efclib_out:
	efct_xport_detach(efct->xport);
xport_out:
	efct_xport_free(efct->xport);
	efct->xport = NULL;
out:
	return rc;

Does this leave the efc struct permanently leaked?

>  	}
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008185403.2791781-1-vulab@iscas.ac.cn?part=1