Re: [PATCH] scsi: elx: efct: fix IO refcount leak in efct_hw_io_abort()

[Daniel Wagner]

On Wed, May 27, 2026 at 10:09:35AM +0000, Wentao Liang wrote:
>  drivers/scsi/elx/efct/efct_hw.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/scsi/elx/efct/efct_hw.c b/drivers/scsi/elx/efct/efct_hw.c
> index 1838032f6486..4ecd6f4165f4 100644
> --- a/drivers/scsi/elx/efct/efct_hw.c
> +++ b/drivers/scsi/elx/efct/efct_hw.c
> @@ -1997,6 +1997,7 @@ efct_hw_io_abort(struct efct_hw *hw, struct efct_hw_io *io_to_abort,
>  	wqcb = efct_hw_reqtag_alloc(hw, efct_hw_wq_process_abort, io_to_abort);
>  	if (!wqcb) {
>  		efc_log_err(hw->os, "can't allocate request tag\n");
> +		kref_put(&io_to_abort->ref, io_to_abort->release);
>  		return -ENOSPC;
>  	}

I think the Sashiko review is wrong. efct_hw_reqtag_alloc will only use
the list_del_init when it was able to allocate an element, thus it
wont return NULL. The Shashiko argument seems to miss how the life time
of those io object are handled and there doesn't seem to be any code
depended on the return value of efct_hw_io_abort too.

Thus it doesn't really matter if efct_hw_io_abort is set or not. It is
more consistent to do so. And efct_hw_init_free_io will initialize
abort_in_progress anyway.