[PATCH v3] scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

[PATCH v3] scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

[Yang Xiuwei]

If device_add(&sdkp->disk_dev) fails, put_device() runs
scsi_disk_release(), which frees the scsi_disk but leaves the gendisk
referenced. The device_add_disk() error path in sd_probe() calls
put_disk(gd); call put_disk(gd) here to mirror that cleanup.

Fixes: 265dfe8ebbab ("scsi: sd: Free scsi_disk device via put_device()")
Cc: stable@vger.kernel.org
Reviewed-by: John Garry <john.g.garry@oracle.com>
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
---
v2: Add Fixes: and Cc: stable; add a short note on how the issue was found.
v3: Commit message and subject refined per review; add Reviewed-by from John Garry.

 drivers/scsi/sd.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 628a1d0a74ba..aba22060fcd5 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -4018,6 +4018,7 @@ static int sd_probe(struct scsi_device *sdp)
 	error = device_add(&sdkp->disk_dev);
 	if (error) {
 		put_device(&sdkp->disk_dev);
+		put_disk(gd);
 		goto out;
 	}
 
-- 
2.25.1

Re: [PATCH v3] scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

[Ming Lei]

On Mon, Mar 30, 2026 at 09:49:52AM +0800, Yang Xiuwei wrote:
> If device_add(&sdkp->disk_dev) fails, put_device() runs
> scsi_disk_release(), which frees the scsi_disk but leaves the gendisk
> referenced. The device_add_disk() error path in sd_probe() calls
> put_disk(gd); call put_disk(gd) here to mirror that cleanup.
> 
> Fixes: 265dfe8ebbab ("scsi: sd: Free scsi_disk device via put_device()")
> Cc: stable@vger.kernel.org
> Reviewed-by: John Garry <john.g.garry@oracle.com>
> Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
> ---
> v2: Add Fixes: and Cc: stable; add a short note on how the issue was found.
> v3: Commit message and subject refined per review; add Reviewed-by from John Garry.
> 
>  drivers/scsi/sd.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index 628a1d0a74ba..aba22060fcd5 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
> @@ -4018,6 +4018,7 @@ static int sd_probe(struct scsi_device *sdp)
>  	error = device_add(&sdkp->disk_dev);
>  	if (error) {
>  		put_device(&sdkp->disk_dev);
> +		put_disk(gd);
>  		goto out;
>  	}

Another fix is to clear `sdkp` and `goto out_put`:

- clearing `sdkp` because the device is released already, and this way is `memory safe`
- `goto out_put` can release disk centrally



Thanks,
Ming

Re: [PATCH v3] scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails

[Yang Xiuwei]

Hi Ming,

On Mon, Mar 30, 2026 at 10:12:51AM +0800, Ming Lei wrote:
> Another fix is to clear `sdkp` and `goto out_put`:
>
> - clearing `sdkp` because the device is released already, and this way is `memory safe`
> - `goto out_put` can release disk centrally
>

Thank you for the suggestion.

As I understand it, the behaviour is the same as in v3: once
put_device(&sdkp->disk_dev) has run, scsi_disk_release() frees the
scsi_disk, so following with put_disk(gd) and goto out avoids the gendisk
leak and also avoids falling through to out_free, where kfree(sdkp) would
no longer be valid.

For now I am inclined to keep the v3 form for simplicity, but I am happy to
switch to your sdkp = NULL + goto out_put approach if you or the
maintainers would find that clearer or more consistent.

Thanks,
Yang Xiuwei