[PATCH] fix: scsi: cxgbi: cxgbi_ep_connect: remove extra cxgbi_sock_get leading to reference leak

From: WenTao Liang

Date: Fri Jun 26 2026 - 12:17:28 EST


In cxgbi_ep_connect(), an explicit cxgbi_sock_get(csk) is called before
sock_get_port(csk), which internally calls cxgbi_sock_get(csk) again.
After sock_get_port, all error paths release only one reference via
release_conn, while the success path returns without releasing any. This
results in one leaked reference on every code path.

Remove the redundant cxgbi_sock_get(csk) call, letting sock_get_port's
internal get serve as the sole reference acquisition.

Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
drivers/scsi/cxgbi/libcxgbi.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index 6a109269c68c..d2e8c8b8a138 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -2891,10 +2891,12 @@ struct iscsi_endpoint *cxgbi_ep_connect(struct Scsi_Host *shost,

if (IS_ERR(csk))
return (struct iscsi_endpoint *)csk;
+
if (!hba)
hba = csk->cdev->hbas[csk->port_id];
else if (hba != csk->cdev->hbas[csk->port_id]) {
if (ifindex != hba->ndev->ifindex) {
+ cxgbi_sock_put(csk);
cxgbi_sock_closed(csk);
ifindex = hba->ndev->ifindex;
goto check_route;
--
2.39.5 (Apple Git-154)