[PATCH] scsi: mpt3sas: drop the sas_device reference on port add failure

[PATCH] scsi: mpt3sas: drop the sas_device reference on port add failure

[Wentao Liang]

mpt3sas_transport_port_add() takes a reference on the sas_device of a SAS
end device with mpt3sas_get_sdev_by_addr(), but only drops it after
sas_rphy_add() has succeeded.

If anything in between fails - no parent device, sas_port_alloc_num() or
sas_port_add() failure, rphy allocation failure, sas_rphy_add() failure -
the error path frees the port and returns without releasing the
reference, so the sas_device can never go away. The pend_sas_rphy_add
flag set for the same window is left behind as well.

Drop the reference and clear the flag in the shared out_fail path.

Fixes: d1cb5e495e53 ("mpt3sas: Refcount sas_device objects and fix unsafe list usage")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/scsi/mpt3sas/mpt3sas_transport.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index e74a526efa8d..38259dae9109 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -866,6 +866,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
 	sas_port_delete(port);
 
 out_fail:
+	if (sas_device) {
+		sas_device->pend_sas_rphy_add = 0;
+		sas_device_put(sas_device);
+	}
 	list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,
 	    port_siblings)
 		list_del(&mpt3sas_phy->port_siblings);
-- 
2.34.1

Re: [PATCH] scsi: mpt3sas: drop the sas_device reference on port add failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: mpt3sas: dangling sas_device->rphy in mpt3sas_transport_port_add()
--

commit 513fa7a846ccb03a4cae94cd2a076f29098310d8
Author: Wentao Liang <vulab@iscas.ac.cn>

scsi: mpt3sas: drop the sas_device reference on port add failure

This commit fixes a sas_device reference leak and clears pend_sas_rphy_add
in the out_fail error path of mpt3sas_transport_port_add() when adding a
SAS end device port fails.

> diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
> index e74a526efa8db..38259dae91093 100644
> --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
> +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
> @@ -866,6 +866,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
>  	sas_port_delete(port);
>  
>  out_fail:
> +	if (sas_device) {
> +		sas_device->pend_sas_rphy_add = 0;
> +		sas_device_put(sas_device);
> +	}

[Severity: Medium]
Should this cleanup block in mpt3sas_transport_port_add() also reset
sas_device->rphy to NULL?

Earlier in mpt3sas_transport_port_add(), when adding a SAS_END_DEVICE,
sas_device->rphy is assigned before sas_rphy_add() is called:

	if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) {
		rphy = sas_end_device_alloc(port);
		sas_device->rphy = rphy;
		...
	}
	...
	if ((sas_rphy_add(rphy))) {
		ioc_err(ioc, "failure at %s:%d/%s()!\n",
			__FILE__, __LINE__, __func__);
		sas_rphy_free(rphy);
		rphy = NULL;
		goto out_delete_port;
	}

If sas_rphy_add() fails, rphy is freed via sas_rphy_free(rphy), and only
the local rphy variable is cleared before jumping to out_delete_port and
out_fail.

Because sas_device remains on ioc->sas_device_list or
ioc->sas_device_init_list (and is also held by the caller),
sas_device_put(sas_device) in out_fail does not free sas_device, leaving
sas_device->rphy as a dangling pointer that __mpt3sas_get_sdev_by_rphy()
can match against a reallocated sas_rphy at the same address.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104021352.1467740-1-vulab@iscas.ac.cn?part=1