* [PATCH 1/2] scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
[not found] <20260812103344.174247-1-mgandhi@redhat.com>
@ 2026-08-12 10:33 ` Milan P. Gandhi
2026-08-12 10:33 ` [PATCH 2/2] scsi: mpi3mr: Fix target device refcount leak " Milan P. Gandhi
1 sibling, 0 replies; 2+ messages in thread
From: Milan P. Gandhi @ 2026-08-12 10:33 UTC (permalink / raw)
To: linux-scsi
Cc: Milan P. Gandhi, Sathya Prakash Veerichetty, Kashyap Desai,
Sumit Saxena, Sreekanth Reddy, James E.J. Bottomley,
Martin K. Petersen, Himanshu Madhani, mpi3mr-linuxdrv.pdl,
linux-kernel
sas_port_alloc_num() can return NULL on memory allocation failure. The
return value is passed directly to sas_port_add() without a NULL check,
which causes a NULL pointer dereference.
Additionally, if sas_port_add() fails, the allocated port is not freed
before jumping to out_fail, leaking the sas_port structure. Call
sas_port_free() to properly release it.
Fixes: e22bae30667a ("scsi: mpi3mr: Add expander devices to STL")
Signed-off-by: Milan P. Gandhi <mgandhi@redhat.com>
---
drivers/scsi/mpi3mr/mpi3mr_transport.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c
index 240f67a8e2e3..ea2c04384a0e 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c
@@ -1428,9 +1428,15 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc,
}
port = sas_port_alloc_num(mr_sas_node->parent_dev);
+ if (!port) {
+ ioc_err(mrioc, "failure at %s:%d/%s()!\n",
+ __FILE__, __LINE__, __func__);
+ goto out_fail;
+ }
if ((sas_port_add(port))) {
ioc_err(mrioc, "failure at %s:%d/%s()!\n",
__FILE__, __LINE__, __func__);
+ sas_port_free(port);
goto out_fail;
}
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread* [PATCH 2/2] scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
[not found] <20260812103344.174247-1-mgandhi@redhat.com>
2026-08-12 10:33 ` [PATCH 1/2] scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() Milan P. Gandhi
@ 2026-08-12 10:33 ` Milan P. Gandhi
1 sibling, 0 replies; 2+ messages in thread
From: Milan P. Gandhi @ 2026-08-12 10:33 UTC (permalink / raw)
To: linux-scsi
Cc: Milan P. Gandhi, Sathya Prakash Veerichetty, Kashyap Desai,
Sumit Saxena, Sreekanth Reddy, James E.J. Bottomley,
Martin K. Petersen, Himanshu Madhani, mpi3mr-linuxdrv.pdl,
linux-kernel
mpi3mr_get_tgtdev_by_addr() increments the target device kref when it
returns a device. If a subsequent error triggers a goto out_fail after
the tgtdev reference is acquired, the reference is never released
because the out_fail path does not call mpi3mr_tgtdev_put(). This
prevents the target device structure from ever being freed.
Add a tgtdev put in the out_fail path, guarded by a NULL check since
tgtdev is only acquired for SAS_END_DEVICE types and the same cleanup
path is shared by earlier error cases where tgtdev is still NULL.
Fixes: e22bae30667a ("scsi: mpi3mr: Add expander devices to STL")
Signed-off-by: Milan P. Gandhi <mgandhi@redhat.com>
---
drivers/scsi/mpi3mr/mpi3mr_transport.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c
index ea2c04384a0e..232af978d737 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c
@@ -1507,6 +1507,8 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc,
list_for_each_entry_safe(mr_sas_phy, next, &mr_sas_port->phy_list,
port_siblings)
list_del(&mr_sas_phy->port_siblings);
+ if (tgtdev)
+ mpi3mr_tgtdev_put(tgtdev);
kfree(mr_sas_port);
return NULL;
}
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread