[PATCH] scsi: iscsi: Remove the endpoint ID only once when device_register() fails

[PATCH] scsi: iscsi: Remove the endpoint ID only once when device_register() fails

[Changyul Lee]

When device_register() fails, iscsi_create_endpoint() removes the
endpoint ID from iscsi_ep_idr, drops iscsi_ep_idr_mutex and then calls
put_device(). put_device() runs iscsi_endpoint_release(), which removes
the same ID again. If another endpoint gets that ID in between, its
entry is removed and iscsi_lookup_endpoint() no longer finds it. The
next endpoint then gets the same ID and fails to register:

[    6.689361] sysfs: cannot create duplicate filename '/devices/virtual/iscsi_endpoint/ep-1'

Leave the removal to iscsi_endpoint_release().

Fixes: f014165faa7b ("scsi: iscsi: Fix possible memory leak when device_register() failed")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
Found with a static analysis tool we are developing. Sashiko AI review
also pointed it out as a pre-existing issue.
https://lore.kernel.org/all/20260617204203.91A3B1F000E9@smtp.kernel.org/

Reproduced in QEMU (x86_64) with CONFIG_DEBUG_KOBJECT_RELEASE, which
delays iscsi_endpoint_release() by 1-4 seconds, and a test module. The
module makes device_register() fail with fail-nth (an allocation in
device_add()), creates a second endpoint and looks it up after the
delayed release. Without this patch, the second endpoint gets the same
ID 1 and is not found, and a third endpoint fails with the error above.
With it, the second endpoint gets ID 2 and is found, and the third gets
ID 1 after the release.

 drivers/scsi/scsi_transport_iscsi.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index b094af7c997e..6e38fbfd5a9d 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -246,9 +246,6 @@ iscsi_create_endpoint(int dd_size)
 	return NULL;
 
 put_dev:
-	mutex_lock(&iscsi_ep_idr_mutex);
-	idr_remove(&iscsi_ep_idr, id);
-	mutex_unlock(&iscsi_ep_idr_mutex);
 	put_device(&ep->dev);
 	return NULL;
 free_ep:

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0