[PATCH] scsi: mvsas: put the Scsi_Host when host setup fails

[PATCH] scsi: mvsas: put the Scsi_Host when host setup fails

[Wentao Liang]

mvs_pci_init() allocates the Scsi_Host with scsi_host_alloc() and, once
everything has been set up, hands it to mvs_pci_remove(), which ends up
dropping the allocation reference through mvs_free().

Probing can fail after the host has been added: scsi_add_host(),
sas_register_ha() and request_irq() all jump to err_out_shost on error,
where the host is removed with scsi_remove_host() but its reference is
never dropped. A failed probe therefore leaves the host allocated for
good.

Put the host after removing it.

Fixes: dd4969a892ea ("[SCSI] mvsas: split driver into multiple files")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/scsi/mvsas/mv_init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
index 5abc17a2e261..9210cb0bb2c1 100644
--- a/drivers/scsi/mvsas/mv_init.c
+++ b/drivers/scsi/mvsas/mv_init.c
@@ -571,6 +571,7 @@ static int mvs_pci_init(struct pci_dev *pdev, const struct pci_device_id *ent)
 	sas_unregister_ha(SHOST_TO_SAS_HA(shost));
 err_out_shost:
 	scsi_remove_host(mvi->shost);
+	scsi_host_put(shost);
 err_out_regions:
 	pci_release_regions(pdev);
 err_out_disable:
-- 
2.34.1

Re: [PATCH] scsi: mvsas: put the Scsi_Host when host setup fails

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] scsi: mvsas: use-after-free in mvs_pci_init() when scsi_add_host() fails
--

commit 6788dffec70edd91c99d1078d3e86b6a8d604507
Author: Wentao Liang <vulab@iscas.ac.cn>

scsi: mvsas: put the Scsi_Host when host setup fails

This commit adds a call to scsi_host_put() after scsi_remove_host() in the
mvs_pci_init() error unwind path so that the Scsi_Host allocation reference
is dropped when probing fails.

> diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c
> index 5abc17a2e2610..9210cb0bb2c11 100644
> --- a/drivers/scsi/mvsas/mv_init.c
> +++ b/drivers/scsi/mvsas/mv_init.c
> @@ -571,6 +571,7 @@ static int mvs_pci_init(struct pci_dev *pdev, const struct pci_device_id *ent)
>  	sas_unregister_ha(SHOST_TO_SAS_HA(shost));
>  err_out_shost:
>  	scsi_remove_host(mvi->shost);
> +	scsi_host_put(shost);

[Severity: High]
Does this cause a use-after-free on shost when scsi_add_host() fails in
mvs_pci_init()?

Earlier in drivers/scsi/mvsas/mv_init.c:mvs_pci_init(), a failed
scsi_add_host() jumps to err_out_shost:

	rc = scsi_add_host(shost, &pdev->dev);
	if (rc)
		goto err_out_shost;

When scsi_add_host_with_dma() fails, it rolls back any partial registration
and leaves shost->shost_gendev with only the single initial allocation
reference from scsi_host_alloc().

Jumping to err_out_shost then calls scsi_remove_host(mvi->shost) on a host
that was not added. Because scsi_host_set_state(shost, SHOST_CANCEL) allows
the transition from SHOST_CREATED to SHOST_CANCEL, scsi_remove_host()
proceeds to unregister shost->shost_dev:

drivers/scsi/hosts.c:scsi_remove_host()
  device_unregister(&shost->shost_dev)
    put_device(&shost->shost_dev)
      scsi_host_cls_release()
        put_device(&shost->shost_gendev)

Depending on where scsi_add_host_with_dma() failed, scsi_remove_host() either
waits on an uninitialized shost->tagset_freed completion or drops the sole
reference on shost->shost_gendev and frees shost, after which the newly added
scsi_host_put(shost) accesses the already-freed Scsi_Host.

Should a failed scsi_add_host() bypass scsi_remove_host() and jump directly to
a label that only calls scsi_host_put(shost)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104021440.1468339-1-vulab@iscas.ac.cn?part=1

Re: [PATCH] scsi: mvsas: put the Scsi_Host when host setup fails

[Krzysztof Kozlowski]

On Wed, 04 Nov 2026 02:14:40 +0000, Wentao Liang wrote:
> mvs_pci_init() allocates the Scsi_Host with scsi_host_alloc() and, once
> everything has been set up, hands it to mvs_pci_remove(), which ends up
> dropping the allocation reference through mvs_free().
> 
> Probing can fail after the host has been added: scsi_add_host(),
> sas_register_ha() and request_irq() all jump to err_out_shost on error,
> where the host is removed with scsi_remove_host() but its reference is
> never dropped. A failed probe therefore leaves the host allocated for
> good.
> 
> Put the host after removing it.
> 
> Fixes: dd4969a892ea ("[SCSI] mvsas: split driver into multiple files")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/scsi/mvsas/mv_init.c | 1 +
>  1 file changed, 1 insertion(+)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof