[PATCH] scsi: elx: efct: fix refcount leak in efct_hw_io_abort()

[PATCH] scsi: elx: efct: fix refcount leak in efct_hw_io_abort()

[WenTao Liang]

When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error
path returns -ENOSPC without releasing the reference obtained via
kref_get_unless_zero() earlier in the function. All other error
paths correctly drop the reference. This causes a permanent
reference leak on the io_to_abort object.

Additionally, the abort_in_progress flag is left set to true on
this path, which means future abort attempts for the same I/O will
immediately return -EINPROGRESS even though the abort was never
submitted, effectively blocking recovery.

Fix this by adding the missing kref_put() call and reset
abort_in_progress to false, matching the cleanup done in the
efct_hw_wq_write() failure path below.

Cc: stable@vger.kernel.org
Fixes: 63de51327a64 ("scsi: elx: efct: Hardware I/O and SGL initialization")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/scsi/elx/efct/efct_hw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/elx/efct/efct_hw.c b/drivers/scsi/elx/efct/efct_hw.c
index 1838032f6486..b79c6a7ea791 100644
--- a/drivers/scsi/elx/efct/efct_hw.c
+++ b/drivers/scsi/elx/efct/efct_hw.c
@@ -1997,6 +1997,8 @@ efct_hw_io_abort(struct efct_hw *hw, struct efct_hw_io *io_to_abort,
 	wqcb = efct_hw_reqtag_alloc(hw, efct_hw_wq_process_abort, io_to_abort);
 	if (!wqcb) {
 		efc_log_err(hw->os, "can't allocate request tag\n");
+		io_to_abort->abort_in_progress = false;
+		kref_put(&io_to_abort->ref, io_to_abort->release);
 		return -ENOSPC;
 	}
 
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] scsi: elx: efct: fix refcount leak in efct_hw_io_abort()

[Daniel Wagner]

On Thu, Jun 11, 2026 at 01:30:37PM +0800, WenTao Liang wrote:
> When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error
> path returns -ENOSPC without releasing the reference obtained via
> kref_get_unless_zero() earlier in the function. All other error
> paths correctly drop the reference. This causes a permanent
> reference leak on the io_to_abort object.
> 
> Additionally, the abort_in_progress flag is left set to true on
> this path, which means future abort attempts for the same I/O will
> immediately return -EINPROGRESS even though the abort was never
> submitted, effectively blocking recovery.
> 
> Fix this by adding the missing kref_put() call and reset
> abort_in_progress to false, matching the cleanup done in the
> efct_hw_wq_write() failure path below.
> 
> Cc: stable@vger.kernel.org
> Fixes: 63de51327a64 ("scsi: elx: efct: Hardware I/O and SGL initialization")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Looks good to me.

Reviewed-by: Daniel Wagner <dwagner@suse.de>

Re: [PATCH] scsi: elx: efct: fix refcount leak in efct_hw_io_abort()

[Martin K. Petersen]

On Thu, 11 Jun 2026 13:30:37 +0800, WenTao Liang wrote:

> When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error
> path returns -ENOSPC without releasing the reference obtained via
> kref_get_unless_zero() earlier in the function. All other error
> paths correctly drop the reference. This causes a permanent
> reference leak on the io_to_abort object.
> 
> Additionally, the abort_in_progress flag is left set to true on
> this path, which means future abort attempts for the same I/O will
> immediately return -EINPROGRESS even though the abort was never
> submitted, effectively blocking recovery.
> 
> [...]

Applied to 7.2/scsi-fixes, thanks!

[1/1] scsi: elx: efct: fix refcount leak in efct_hw_io_abort()
      https://git.kernel.org/mkp/scsi/c/2c007acf7b31

-- 
Martin K. Petersen