[PATCH] scsi: libfc: Fix rport kref leak in fc_rport_enter_ready()

[PATCH] scsi: libfc: Fix rport kref leak in fc_rport_enter_ready()

[Weidong Wang via B4 Relay]

From: Weidong Wang <weidongw@illinois.edu>

fc_rport_enter_ready() takes a reference on the rport unconditionally,
but only queues event_work, whose handler drops that reference, when no
event is pending. If rdata->event is already set, the && short-circuits
past both queue_work() and the compensating kref_put(), so the reference
is leaked and the fc_rport_priv is never freed.

This is reachable from the wire: a PLOGI from a well-known address goes
straight to fc_rport_enter_ready(), and a second PLOGI for the same
S_ID while RPORT_EV_READY is still pending enters it again. After the
rport is logged out, kmemleak reports:

  unreferenced object 0xffff888... (size 512):
  backtrace:
    __kmalloc_noprof
    fc_rport_create
    fc_rport_recv_req
    fc_lport_recv_els_req
    fc_lport_recv
    fcoe_receive_work

Commit 823a65409c89 ("scsi: libfc: Skip additional kref updating work
event") fixed the same pattern in fc_rport_enter_delete(). Do the same
here: only take the reference when no event is pending, i.e. when the
work is actually going to be queued.

The issue was found with an LLM-based bug-finding tool; the reproducer,
fix and changelog were drafted with AI assistance (Claude), then
reviewed and tested by the submitter.

Fixes: 4d2095cc42a2 ("scsi: libfc: Revisit kref handling")
Cc: stable@vger.kernel.org
Signed-off-by: Weidong Wang <weidongw@illinois.edu>
---
Tested on v7.4-rc1 (05441d697f7f), x86_64, KASAN + kmemleak, QEMU/KVM.
Reproducer: software FCoE instance on lo; raw FCoE ELS frames injected
with AF_PACKET (PLOGI from well-known S_IDs 0xfffc01.., a second PLOGI
for the same S_ID while RPORT_EV_READY is pending, then LOGO), 120 rports.

                   2nd enter_ready with    kmemleak unreferenced
                   event pending           fc_rport_priv (512 B)
  unpatched        116                     99
  patched          104                     0

READY/delete work events are processed the same with and without the
patch; no KASAN/UBSAN/WARN splats. checkpatch clean, no new W=1 warnings.
The reproducer can be shared on request.
---
 drivers/scsi/libfc/fc_rport.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index c25979d96..7b0938544 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -550,10 +550,11 @@ static void fc_rport_enter_ready(struct fc_rport_priv *rdata)
 
 	FC_RPORT_DBG(rdata, "Port is Ready\n");
 
-	kref_get(&rdata->kref);
-	if (rdata->event == RPORT_EV_NONE &&
-	    !queue_work(rport_event_queue, &rdata->event_work))
-		kref_put(&rdata->kref, fc_rport_destroy);
+	if (rdata->event == RPORT_EV_NONE) {
+		kref_get(&rdata->kref);
+		if (!queue_work(rport_event_queue, &rdata->event_work))
+			kref_put(&rdata->kref, fc_rport_destroy);
+	}
 
 	rdata->event = RPORT_EV_READY;
 }

---
base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
change-id: 20261108-h123-send-723aeb555069

Best regards,
--  
Weidong Wang <weidongw@illinois.edu>

Re: [PATCH] scsi: libfc: Fix rport kref leak in fc_rport_enter_ready()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] scsi: libfc: reference leak in fc_rport_work() [1]
--

commit f18e1c7bd3d9738ea4413b32cfed69e7594a5a24
Author: Weidong Wang <weidongw@illinois.edu>

scsi: libfc: Fix rport kref leak in fc_rport_enter_ready()

This commit avoids taking a reference on rdata->kref in
fc_rport_enter_ready() when rdata->event is already pending and
rdata->event_work will not be queued.

> diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
> index c25979d96808a..7b093854462e4 100644
> --- a/drivers/scsi/libfc/fc_rport.c
> +++ b/drivers/scsi/libfc/fc_rport.c
> @@ -550,10 +550,11 @@ static void fc_rport_enter_ready(struct fc_rport_priv *rdata)
>  
>  	FC_RPORT_DBG(rdata, "Port is Ready\n");
>  
> -	kref_get(&rdata->kref);
> -	if (rdata->event == RPORT_EV_NONE &&
> -	    !queue_work(rport_event_queue, &rdata->event_work))
> -		kref_put(&rdata->kref, fc_rport_destroy);
> +	if (rdata->event == RPORT_EV_NONE) {
> +		kref_get(&rdata->kref);
> +		if (!queue_work(rport_event_queue, &rdata->event_work))
> +			kref_put(&rdata->kref, fc_rport_destroy);
> +	}
>  
>  	rdata->event = RPORT_EV_READY;
>  }

[Severity: Medium]
This problem wasn't introduced by this patch, but doesn't the RPORT_EV_READY
handler in fc_rport_work() also leak the workqueue reference taken here when
fc_remote_port_add() fails [1]?

drivers/scsi/libfc/fc_rport.c:fc_rport_work() {
	switch (event) {
	case RPORT_EV_READY:
		...
		kref_get(&rdata->kref);
		mutex_unlock(&rdata->rp_mutex);

		if (!rport) {
			FC_RPORT_DBG(rdata, "No rport!\n");
			rport = fc_remote_port_add(lport->host, 0, &ids);
		}
		if (!rport) {
			FC_RPORT_DBG(rdata, "Failed to add the rport\n");
			fc_rport_logoff(rdata);
			kref_put(&rdata->kref, fc_rport_destroy);
			return;
		}
		...
		kref_put(&rdata->kref, fc_rport_destroy);
		break;
	...
	}
	kref_put(&rdata->kref, fc_rport_destroy);
}

The error path drops the local reference taken before unlocking rp_mutex,
and then returns directly instead of breaking out to the final kref_put() at
the end of fc_rport_work(), permanently leaking rdata.

[1] https://sashiko.dev/#/bug/linux-f352567a-e977-44cd-9965-6ccd520fb22b

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108-h123-send-v1-1-b7672ff849f0@illinois.edu?part=1

Re: [PATCH] scsi: libfc: Fix rport kref leak in fc_rport_enter_ready()

[Hannes Reinecke]

On 11/8/26 10:01 AM, Weidong Wang via B4 Relay wrote:
> From: Weidong Wang <weidongw@illinois.edu>
> 
> fc_rport_enter_ready() takes a reference on the rport unconditionally,
> but only queues event_work, whose handler drops that reference, when no
> event is pending. If rdata->event is already set, the && short-circuits
> past both queue_work() and the compensating kref_put(), so the reference
> is leaked and the fc_rport_priv is never freed.
> 
> This is reachable from the wire: a PLOGI from a well-known address goes
> straight to fc_rport_enter_ready(), and a second PLOGI for the same
> S_ID while RPORT_EV_READY is still pending enters it again. After the
> rport is logged out, kmemleak reports:
> 
>    unreferenced object 0xffff888... (size 512):
>    backtrace:
>      __kmalloc_noprof
>      fc_rport_create
>      fc_rport_recv_req
>      fc_lport_recv_els_req
>      fc_lport_recv
>      fcoe_receive_work
> 
> Commit 823a65409c89 ("scsi: libfc: Skip additional kref updating work
> event") fixed the same pattern in fc_rport_enter_delete(). Do the same
> here: only take the reference when no event is pending, i.e. when the
> work is actually going to be queued.
> 
> The issue was found with an LLM-based bug-finding tool; the reproducer,
> fix and changelog were drafted with AI assistance (Claude), then
> reviewed and tested by the submitter.
> 
> Fixes: 4d2095cc42a2 ("scsi: libfc: Revisit kref handling")
> Cc: stable@vger.kernel.org
> Signed-off-by: Weidong Wang <weidongw@illinois.edu>
> ---
> Tested on v7.4-rc1 (05441d697f7f), x86_64, KASAN + kmemleak, QEMU/KVM.
> Reproducer: software FCoE instance on lo; raw FCoE ELS frames injected
> with AF_PACKET (PLOGI from well-known S_IDs 0xfffc01.., a second PLOGI
> for the same S_ID while RPORT_EV_READY is pending, then LOGO), 120 rports.
> 
>                     2nd enter_ready with    kmemleak unreferenced
>                     event pending           fc_rport_priv (512 B)
>    unpatched        116                     99
>    patched          104                     0
> 
> READY/delete work events are processed the same with and without the
> patch; no KASAN/UBSAN/WARN splats. checkpatch clean, no new W=1 warnings.
> The reproducer can be shared on request.
> ---
>   drivers/scsi/libfc/fc_rport.c | 9 +++++----
>   1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
> index c25979d96..7b0938544 100644
> --- a/drivers/scsi/libfc/fc_rport.c
> +++ b/drivers/scsi/libfc/fc_rport.c
> @@ -550,10 +550,11 @@ static void fc_rport_enter_ready(struct fc_rport_priv *rdata)
>   
>   	FC_RPORT_DBG(rdata, "Port is Ready\n");
>   
> -	kref_get(&rdata->kref);
> -	if (rdata->event == RPORT_EV_NONE &&
> -	    !queue_work(rport_event_queue, &rdata->event_work))
> -		kref_put(&rdata->kref, fc_rport_destroy);
> +	if (rdata->event == RPORT_EV_NONE) {
> +		kref_get(&rdata->kref);
> +		if (!queue_work(rport_event_queue, &rdata->event_work))
> +			kref_put(&rdata->kref, fc_rport_destroy);
> +	}
>   
>   	rdata->event = RPORT_EV_READY;
>   }
> 
> ---
> base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
> change-id: 20261108-h123-send-723aeb555069
> 
> Best regards,
> --
> Weidong Wang <weidongw@illinois.edu>
> 
> 
Reviewed-by: Hannes Reinecke <hare@kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich