Re: [PATCH v3] scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

[Ming Lei <ming.lei@redhat.com>]

On Mon, Mar 30, 2026 at 09:49:52AM +0800, Yang Xiuwei wrote:
> If device_add(&sdkp->disk_dev) fails, put_device() runs
> scsi_disk_release(), which frees the scsi_disk but leaves the gendisk
> referenced. The device_add_disk() error path in sd_probe() calls
> put_disk(gd); call put_disk(gd) here to mirror that cleanup.
> 
> Fixes: 265dfe8ebbab ("scsi: sd: Free scsi_disk device via put_device()")
> Cc: stable@vger.kernel.org
> Reviewed-by: John Garry <john.g.garry@oracle.com>
> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
> ---
> v2: Add Fixes: and Cc: stable; add a short note on how the issue was found.
> v3: Commit message and subject refined per review; add Reviewed-by from John Garry.
> 
>  drivers/scsi/sd.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index 628a1d0a74ba..aba22060fcd5 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
> @@ -4018,6 +4018,7 @@ static int sd_probe(struct scsi_device *sdp)
>  	error = device_add(&sdkp->disk_dev);
>  	if (error) {
>  		put_device(&sdkp->disk_dev);
> +		put_disk(gd);
>  		goto out;
>  	}

Another fix is to clear `sdkp` and `goto out_put`:

- clearing `sdkp` because the device is released already, and this way is `memory safe`
- `goto out_put` can release disk centrally



Thanks,
Ming