The reference counting issue happens in several exception handling paths
of mpt3sas_transport_port_add(). When those error scenarios occur such
as allocating sas port failed, the function forgets to decrease the
refcount of "sas_device" increased by mpt3sas_get_sdev_by_addr(),
causing a refcount leak.
Fix this issue by jumping to "out_device_put" label when error occurred.
Signed-off-by: Xiyu Yang <xiyuyang19@xxxxxxxxxxxx>
Signed-off-by: Xin Tan <tanxin.ctf@xxxxxxxxx>
---
drivers/scsi/mpt3sas/mpt3sas_transport.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index 0681daee6c14..089aa2321d0f 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -782,13 +782,13 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
if (!sas_node->parent_dev) {
ioc_err(ioc, "failure at %s:%d/%s()!\n",
__FILE__, __LINE__, __func__);
- goto out_fail;
+ goto out_device_put;
}
port = sas_port_alloc_num(sas_node->parent_dev);
if ((sas_port_add(port))) {
ioc_err(ioc, "failure at %s:%d/%s()!\n",
__FILE__, __LINE__, __func__);
- goto out_fail;
+ goto out_device_put;
}
list_for_each_entry(mpt3sas_phy, &mpt3sas_port->phy_list,
@@ -855,6 +855,11 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
rphy_to_expander_device(rphy), hba_port->port_id);
return mpt3sas_port;
+ out_device_put:
+ if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) {
+ sas_device->pend_sas_rphy_add = 0;
+ sas_device_put(sas_device);
+ }
out_fail:
list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,
port_siblings)
--
2.7.4
