Re: [PATCH 5.15 177/570] scsi: core: Fix error handling for scsi_alloc_sdev()

Harshit Mogalapalli
2026-04-14T16:07:43Z

Hi,

On 13/04/26 21:25, Greg Kroah-Hartman wrote:
> 5.15-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Junxiao Bi <junxiao.bi@oracle.com>
>
> commit 4ce7ada40c008fa21b7e52ab9d04e8746e2e9325 upstream.
>
> After scsi_sysfs_device_initialize() was called, error paths must call
> __scsi_remove_device().
>
> Fixes: 1ac22c8eae81 ("scsi: core: Fix refcount leak for tagset_refcnt")
> Cc: stable@vger.kernel.org
> Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
> Reviewed-by: John Garry <john.g.garry@oracle.com>
> Reviewed-by: Bart Van Assche <bvanassche@acm.org>
> Link: https://patch.msgid.link/20260304164603.51528-1-junxiao.bi@oracle.com
> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/scsi/scsi_scan.c | 8 ++------
> 1 file changed, 2 insertions(+), 6 deletions(-)
>
> --- a/drivers/scsi/scsi_scan.c
> +++ b/drivers/scsi/scsi_scan.c
> @@ -339,12 +339,8 @@ static struct scsi_device *scsi_alloc_sd
> * default device queue depth to figure out sbitmap shift
> * since we use this queue depth most of times.
> */
> - if (scsi_realloc_sdev_budget_map(sdev, depth)) {
> - kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags);
> - put_device(&starget->dev);
> - kfree(sdev);
> - goto out;
> - }
> + if (scsi_realloc_sdev_budget_map(sdev, depth))
> + goto out_device_destroy;
>

I have run an AI assisted backport review and it spotted an issue: I
have taken a look and the issue is:

5.15.y doesn't have commit: 21008cabc5d9 ("scsi: core: Move two
statements") - v6.19-rc1 based so backporting this patch introduces
something like:

if (scsi_realloc_sdev_budget_map(sdev, depth))
goto out_device_destroy;

scsi_change_queue_depth(sdev, depth);
scsi_sysfs_device_initialize(sdev);

...
out_device_destroy:
__scsi_remove_device(sdev);

calling put_device() before device_initialize(), so I think we should
drop this patch in stable branches which don't have commit: 21008cabc5d9
("scsi: core: Move two statements") in them. Upstream moved
scsi_sysfs_device_initialize() above the budget_map() call.

Thoughts ?

I see the same problem in other stable branches as well.

Thanks,
Harshit

> scsi_change_queue_depth(sdev, depth);
>
>
>
>