Re: linux-next: manual merge of the scsi-mkp tree with the scsi tree

[Ranjan Kumar]

Hi Geert and Mark,

Author of commit 29e3f0856e854 here - confirming Geert is right, this is a genuine double-put, not a style difference.

mpi3mr_tgtdev_put() is a plain kref_put(&s->ref_count, mpi3mr_free_tgtdev).
The block earlier in the same function already does the full cleanup on this error path:

if (tgtdev) {
        tgtdev->dev_spec.sas_sata_inf.pend_sas_rphy_add = 0;
        tgtdev->dev_spec.sas_sata_inf.rphy = NULL;
        mpi3mr_tgtdev_put(tgtdev);
}

The "if (tgtdev) mpi3mr_tgtdev_put(tgtdev)" right before kfree(mr_sas_port) is a second,
independent fix for the same underlying leak that duplicates it.
With both present, this path releases the reference twice for what should be a
single release - either double-decrementing a refcount another caller still relies on,
or touching freed memory if this was the last reference.

The fix is to drop the second occurrence and keep the first,
since it also clears pend_sas_rphy_add/rphy before releasing the reference, which the duplicate does not:

list_for_each_entry_safe(mr_sas_phy, next, &mr_sas_port->phy_list,
port_siblings) {
mr_sas_phy->phy_belongs_to_port = 0;
list_del(&mr_sas_phy->port_siblings);
}
- if (tgtdev)
- mpi3mr_tgtdev_put(tgtdev);
kfree(mr_sas_port);

Thanks,
Ranjan

On Wed, Sep 30, 2026 at 12:42 PM Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> wrote:

Hi Mark,

On Tue, 29 Sept 2026 at 13:07, Mark Brown <broonie@xxxxxxxxxx> wrote:
> On Tue, Sep 29, 2026 at 10:48:09AM +0200, Geert Uytterhoeven wrote:
> > On Mon, 28 Sept 2026 at 16:23, Mark Brown <broonie@xxxxxxxxxx> wrote:
>
> > >         }
> > >  -      if (tgtdev)
> > >  -              mpi3mr_tgtdev_put(tgtdev);
> > >         kfree(mr_sas_port);
> > >         return NULL;
> > >   }
>
> > Are you sure this is correct?
> > Martin's conflict resolution in 0b5b2fb484f3b kept the
>
> >        if (tgtdev)
> >                mpi3mr_tgtdev_put(tgtdev);
>
> > part.
>
> Dunno.  There was another put came in further up the function.

Right. So Martin's resolution looks incorrect, too, as it calls
mpi3mr_tgtdev_put(tgtdev) twice.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature