Re: [PATCH] [SCSI] advansys: fix host resource leak in EISA probe error path

[Hannes Reinecke <hare@suse.com>]

On 4/16/26 18:59, Guangshuo Li wrote:
> A manual code audit found that advansys_eisa_probe() frees saved
> Scsi_Host objects directly in its error path.
> 
> Those hosts have already been successfully initialized by
> advansys_board_found(), so freeing them directly bypasses the normal
> teardown path and leaks host resources such as IRQs, DMA or MMIO
> resources, and the Scsi_Host release path.
> 
> Fix this by releasing the saved hosts with advansys_release() and
> dropping their corresponding I/O regions before freeing the probe data.
> 
> Fixes: d361db483241 ("[SCSI] advansys: Sort out irq number mess")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>   drivers/scsi/advansys.c | 14 +++++++++++---
>   1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
> index fcf059bf41e8..022a8190ae31 100644
> --- a/drivers/scsi/advansys.c
> +++ b/drivers/scsi/advansys.c
> @@ -11373,9 +11373,17 @@ static int advansys_eisa_probe(struct device *dev)
>   	return 0;
>   
>    free_data:
> -	kfree(data->host[0]);
> -	kfree(data->host[1]);
> -	kfree(data);
> +	for (i = 0; i < 2; i++) {
> +		struct Scsi_Host *shost = data->host[i];
> +		int ioport;
> +
> +		if (!shost)
> +			continue;
> +
> +		ioport = shost->io_port;
> +		advansys_release(shost);
> +		release_region(ioport, ASC_IOADR_GAP);
> +	}
>    fail:
>   	return err;
>   }

You must be kidding ... EISA is died over a decade ago.

If you _really_ are concerned about this please remove EISA support 
completely from the driver.

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.com                               +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich