[PATCH] scsi: snic: Fix scsi host leak on workqueue allocation failure

[PATCH] scsi: snic: Fix scsi host leak on workqueue allocation failure

[Chen Changcheng]

In snic_add_host(), if scsi_add_host() succeeds but
alloc_ordered_workqueue() fails, the function returns -ENOMEM
with shost->work_q left as NULL. The caller's error path then
calls snic_del_host(), which returns early when !shost->work_q
without calling scsi_remove_host(). The Scsi_Host remains
registered in sysfs as a zombie device even after the probe
has failed. This causes:

 - The leaked host remains visible in /sys/class/scsi_host/
   after probe failure, with state "running".
 - Subsequent SCSI host numbering is permanently shifted
   (the leaked host ID from ida_alloc() is never reclaimed).
 - Memory leak: the Scsi_Host allocation can never be freed
   because device_add() took a reference that can only be
   released by device_del() inside scsi_remove_host().

Fix by adding scsi_remove_host() in the workqueue allocation
failure path inside snic_add_host(), undoing the successful
scsi_add_host() before returning the error. This is cleaner
than modifying snic_del_host() because snic_del_host() is
called from a shared error label that also serves paths where
snic_add_host() was never invoked.

Reproducer (requires no real SNIC hardware):
 - Build CONFIG_SCSI_SNIC=y (built-in)
 - Add snic.test_mode=1 snic.inject_wq_fail=1 to kernel cmdline
 - Boot with a PCI device matching the snic driver (e.g. QEMU
   edu device, PCI ID 0x1234:0x11e8, temporarily added to the
   driver's PCI ID table)

Before the fix:
  # /sys/class/scsi_host/ contains a zombie host0:
  $ cat /sys/class/scsi_host/host0/proc_name
  snic_scsi
  $ cat /sys/class/scsi_host/host0/state
  running
  # ata_piix gets host1, host2 (host0 stuck):
  scsi host1: ata_piix
  scsi host2: ata_piix

After the fix:
  # host0 is properly freed and reused by ata_piix:
  scsi host0: ata_piix
  scsi host1: ata_piix
  # No zombie host in /sys/class/scsi_host/

Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
---
 drivers/scsi/snic/snic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/snic/snic_main.c b/drivers/scsi/snic/snic_main.c
index 82953e6a0915..cd638b4a4d7b 100644
--- a/drivers/scsi/snic/snic_main.c
+++ b/drivers/scsi/snic/snic_main.c
@@ -305,6 +305,7 @@ snic_add_host(struct Scsi_Host *shost, struct pci_dev *pdev)
 	if (!shost->work_q) {
 		SNIC_HOST_ERR(shost, "Failed to Create ScsiHost wq.\n");
 
+		scsi_remove_host(shost);
 		ret = -ENOMEM;
 	}
 
-- 
2.25.1

Re: [PATCH] scsi: snic: Fix scsi host leak on workqueue allocation failure

[Narsimhulu Musini (nmusini)]

________________________________________
From: Chen Changcheng <chenchangcheng@kylinos.cn>
Sent: 27 July 2026 12:34 AM
To: Karan Tilak Kumar (kartilak) <kartilak@cisco.com>; Narsimhulu Musini (nmusini) <nmusini@cisco.com>; Sesidhar Baddela (sebaddel) <sebaddel@cisco.com>; ames.Bottomley@HansenPartnership.com <ames.Bottomley@HansenPartnership.com>; martin.petersen@oracle.com <martin.petersen@oracle.com>
Cc: linux-scsi@vger.kernel.org <linux-scsi@vger.kernel.org>; linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>; ccc194101@163.com <ccc194101@163.com>; Chen Changcheng <chenchangcheng@kylinos.cn>
Subject: [PATCH] scsi: snic: Fix scsi host leak on workqueue allocation failure
 
In snic_add_host(), if scsi_add_host() succeeds but
alloc_ordered_workqueue() fails, the function returns -ENOMEM
with shost->work_q left as NULL. The caller's error path then
calls snic_del_host(), which returns early when !shost->work_q
without calling scsi_remove_host(). The Scsi_Host remains
registered in sysfs as a zombie device even after the probe
has failed. This causes:

 - The leaked host remains visible in /sys/class/scsi_host/
   after probe failure, with state "running".
 - Subsequent SCSI host numbering is permanently shifted
   (the leaked host ID from ida_alloc() is never reclaimed).
 - Memory leak: the Scsi_Host allocation can never be freed
   because device_add() took a reference that can only be
   released by device_del() inside scsi_remove_host().

Fix by adding scsi_remove_host() in the workqueue allocation
failure path inside snic_add_host(), undoing the successful
scsi_add_host() before returning the error. This is cleaner
than modifying snic_del_host() because snic_del_host() is
called from a shared error label that also serves paths where
snic_add_host() was never invoked.

Reproducer (requires no real SNIC hardware):
 - Build CONFIG_SCSI_SNIC=y (built-in)
 - Add snic.test_mode=1 snic.inject_wq_fail=1 to kernel cmdline
 - Boot with a PCI device matching the snic driver (e.g. QEMU
   edu device, PCI ID 0x1234:0x11e8, temporarily added to the
   driver's PCI ID table)

Before the fix:
  # /sys/class/scsi_host/ contains a zombie host0:
  $ cat /sys/class/scsi_host/host0/proc_name
  snic_scsi
  $ cat /sys/class/scsi_host/host0/state
  running
  # ata_piix gets host1, host2 (host0 stuck):
  scsi host1: ata_piix
  scsi host2: ata_piix

After the fix:
  # host0 is properly freed and reused by ata_piix:
  scsi host0: ata_piix
  scsi host1: ata_piix
  # No zombie host in /sys/class/scsi_host/

Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
Acked-by: Narsimhulu Musini <nmusini@cisco.com>
---
 drivers/scsi/snic/snic_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/snic/snic_main.c b/drivers/scsi/snic/snic_main.c
index 82953e6a0915..cd638b4a4d7b 100644
--- a/drivers/scsi/snic/snic_main.c
+++ b/drivers/scsi/snic/snic_main.c
@@ -305,6 +305,7 @@ snic_add_host(struct Scsi_Host *shost, struct pci_dev *pdev)
         if (!shost->work_q) {
                 SNIC_HOST_ERR(shost, "Failed to Create ScsiHost wq.\n");
 
+               scsi_remove_host(shost);
                 ret = -ENOMEM;
         }
 
--
2.25.1

Re: [PATCH] scsi: snic: Fix scsi host leak on workqueue allocation failure

[Martin K. Petersen (Oracle)]

Chen,

> In snic_add_host(), if scsi_add_host() succeeds but
> alloc_ordered_workqueue() fails, the function returns -ENOMEM with
> shost->work_q left as NULL. The caller's error path then calls
> snic_del_host(), which returns early when !shost->work_q without
> calling scsi_remove_host(). The Scsi_Host remains registered in sysfs
> as a zombie device even after the probe has failed. This causes:

Applied to 7.3/scsi-staging, thanks!

-- 
Martin K. Petersen

Re: [PATCH] scsi: snic: Fix scsi host leak on workqueue allocation failure

[Martin K. Petersen (Oracle)]

On Mon, 27 Jul 2026 15:34:38 +0800, Chen Changcheng wrote:

> In snic_add_host(), if scsi_add_host() succeeds but
> alloc_ordered_workqueue() fails, the function returns -ENOMEM
> with shost->work_q left as NULL. The caller's error path then
> calls snic_del_host(), which returns early when !shost->work_q
> without calling scsi_remove_host(). The Scsi_Host remains
> registered in sysfs as a zombie device even after the probe
> has failed. This causes:
> 
> [...]

Applied to 7.3/scsi-queue, thanks!

[1/1] scsi: snic: Fix scsi host leak on workqueue allocation failure
      https://git.kernel.org/mkp/scsi/c/12e67eb89eb2

-- 
Martin K. Petersen