linux-kernel - [PATCH v2 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251230145858.1356864-2-zilin@seu.edu.cn>
Date: Tue, 30 Dec 2025 14:58:56 +0000
From: Zilin Guan <zilin@....edu.cn>
To: justin.tee@...adcom.com
Cc: paul.ely@...adcom.com,
	James.Bottomley@...senPartnership.com,
	martin.petersen@...cle.com,
	Markus.Elfring@....de,
	jianhao.xu@....edu.cn,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Zilin Guan <zilin@....edu.cn>
Subject: [PATCH v2 1/3] scsi: lpfc: Fix memory leak in lpfc_config_port_post()

In lpfc_config_port_post(), pmb is allocated via mempool_alloc() but
is not freed when lpfc_readl() fails.

Instead of simply adding the missing free, refactor the error handling
to use a goto label. This unifies the cleanup logic and ensures pmb is
freed in all error paths.

Fixes: 9940b97bb30d ("[SCSI] lpfc 8.3.22: Add support for PCI Adapter Failure")
Suggested-by: Markus Elfring <Markus.Elfring@....de>
Co-developed-by: Jianhao Xu <jianhao.xu@....edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@....edu.cn>
Signed-off-by: Zilin Guan <zilin@....edu.cn>
---
v2:
- Refactor error handling to use a goto label for cleanup.

 drivers/scsi/lpfc/lpfc_init.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index b1460b16dd91..1390d2b5095d 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -511,8 +511,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 				"READ_CONFIG, mbxStatus x%x\n",
 				mb->mbxCommand, mb->mbxStatus);
 		phba->link_state = LPFC_HBA_ERROR;
-		mempool_free( pmb, phba->mbox_mem_pool);
-		return -EIO;
+		goto out_free;
 	}
 
 	/* Check if the port is disabled */
@@ -550,8 +549,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 	if (phba->intr_type == MSIX) {
 		rc = lpfc_config_msi(phba, pmb);
 		if (rc) {
-			mempool_free(pmb, phba->mbox_mem_pool);
-			return -EIO;
+			goto out_free;
 		}
 		rc = lpfc_sli_issue_mbox(phba, pmb, MBX_POLL);
 		if (rc != MBX_SUCCESS) {
@@ -560,8 +558,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 					"failed, mbxCmd x%x, mbxStatus x%x\n",
 					pmb->u.mb.mbxCommand,
 					pmb->u.mb.mbxStatus);
-			mempool_free(pmb, phba->mbox_mem_pool);
-			return -EIO;
+			goto out_free;
 		}
 	}
 
@@ -572,7 +569,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 	/* Enable appropriate host interrupts */
 	if (lpfc_readl(phba->HCregaddr, &status)) {
 		spin_unlock_irq(&phba->hbalock);
-		return -EIO;
+		goto out_free;
 	}
 	status |= HC_MBINT_ENA | HC_ERINT_ENA | HC_LAINT_ENA;
 	if (psli->num_rings > 0)
@@ -616,9 +613,7 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 			lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
 					"2599 Adapter failed to issue DOWN_LINK"
 					" mbox command rc 0x%x\n", rc);
-
-			mempool_free(pmb, phba->mbox_mem_pool);
-			return -EIO;
+			goto out_free;
 		}
 	} else if (phba->cfg_suppress_link_up == LPFC_INITIALIZE_LINK) {
 		mempool_free(pmb, phba->mbox_mem_pool);
@@ -666,6 +661,10 @@ lpfc_config_port_post(struct lpfc_hba *phba)
 	}
 
 	return 0;
+
+out_free:
+	mempool_free(pmb, phba->mbox_mem_pool);
+	return -EIO;
 }
 
 /**
-- 
2.34.1