Re: [PATCH] scsi: lpfc: Fix ndlp reference leak in lpfc_release_rpi()

[Paul Ely]

Since you are fixing up the return values, could you also fix the -EIO
in lpfc_sli_issue_mbox_s4 to return MBXERR_ERROR?  The patch will work
in case of -EIO return but clearly lpfc_release_rpi isn't looking for
a negative MBX return status.

Thanks



On Thu, Sep 17, 2026 at 3:35 PM Paul Ely <paul.ely@xxxxxxxxxxxx> wrote:
>
> Thanks Wentao,
> I need some time to read this one and test it.
>
> Thanks
>
> On Thu, Sep 17, 2026 at 10:48 AM Wentao Liang <vulab@xxxxxxxxxxx> wrote:
> >
> > lpfc_release_rpi() only drops the node reference and frees the mailbox
> > memory it took when lpfc_sli_issue_mbox() returns MBX_NOT_FINISHED.  The
> > SLI-4 issue path can also return -EIO without submitting the command, in
> > which case the completion handler never runs and both are leaked.
> >
> > Clean up whenever the command was not handed to the port.
> >
> > Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> > ---
> >  drivers/scsi/lpfc/lpfc_nportdisc.c | 8 +++++++-
> >  1 file changed, 7 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
> > index 9c449055a55e..055f44ec7b94 100644
> > --- a/drivers/scsi/lpfc/lpfc_nportdisc.c
> > +++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
> > @@ -1142,7 +1142,13 @@ lpfc_release_rpi(struct lpfc_hba *phba, struct lpfc_vport *vport,
> >                                  ndlp->nlp_rpi, ndlp->nlp_DID, ndlp->nlp_flag);
> >
> >                 rc = lpfc_sli_issue_mbox(phba, pmb, MBX_NOWAIT);
> > -               if (rc == MBX_NOT_FINISHED) {
> > +
> > +               /* Only a queued or completed command is handed to the
> > +                * port; other results, such as the -EIO returned by the
> > +                * SLI-4 path when it cannot submit a non-polled command,
> > +                * leave the mailbox and the node reference to the caller.
> > +                */
> > +               if (rc != MBX_SUCCESS && rc != MBX_BUSY) {
> >                         lpfc_nlp_put(ndlp);
> >                         mempool_free(pmb, phba->mbox_mem_pool);
> >                 }
> > --
> > 2.34.1
> >

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature