Re: linux-next: manual merge of the scsi-mkp tree with the scsi tree

[Ranjan Kumar <ranjan.kumar@broadcom.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2575 bytes --]

Hi Geert and Mark,

Author of commit 29e3f0856e854 here - confirming Geert is right, this is a
genuine double-put, not a style difference.

mpi3mr_tgtdev_put() is a plain kref_put(&s->ref_count, mpi3mr_free_tgtdev).
The block earlier in the same function already does the full cleanup on
this error path:

if (tgtdev) {
        tgtdev->dev_spec.sas_sata_inf.pend_sas_rphy_add = 0;
        tgtdev->dev_spec.sas_sata_inf.rphy = NULL;
        mpi3mr_tgtdev_put(tgtdev);
}

The "if (tgtdev) mpi3mr_tgtdev_put(tgtdev)" right before kfree(mr_sas_port)
is a second,
independent fix for the same underlying leak that duplicates it.
With both present, this path releases the reference twice for what should
be a
single release - either double-decrementing a refcount another caller still
relies on,
or touching freed memory if this was the last reference.

The fix is to drop the second occurrence and keep the first,
since it also clears pend_sas_rphy_add/rphy before releasing the reference,
which the duplicate does not:

list_for_each_entry_safe(mr_sas_phy, next, &mr_sas_port->phy_list,
port_siblings) {
mr_sas_phy->phy_belongs_to_port = 0;
list_del(&mr_sas_phy->port_siblings);
}
- if (tgtdev)
- mpi3mr_tgtdev_put(tgtdev);
kfree(mr_sas_port);

Thanks,
Ranjan


On Wed, Sep 30, 2026 at 12:42 PM Geert Uytterhoeven <geert@linux-m68k.org>
wrote:

> Hi Mark,
>
> On Tue, 29 Sept 2026 at 13:07, Mark Brown <broonie@kernel.org> wrote:
> > On Tue, Sep 29, 2026 at 10:48:09AM +0200, Geert Uytterhoeven wrote:
> > > On Mon, 28 Sept 2026 at 16:23, Mark Brown <broonie@kernel.org> wrote:
> >
> > > >         }
> > > >  -      if (tgtdev)
> > > >  -              mpi3mr_tgtdev_put(tgtdev);
> > > >         kfree(mr_sas_port);
> > > >         return NULL;
> > > >   }
> >
> > > Are you sure this is correct?
> > > Martin's conflict resolution in 0b5b2fb484f3b kept the
> >
> > >        if (tgtdev)
> > >                mpi3mr_tgtdev_put(tgtdev);
> >
> > > part.
> >
> > Dunno.  There was another put came in further up the function.
>
> Right. So Martin's resolution looks incorrect, too, as it calls
> mpi3mr_tgtdev_put(tgtdev) twice.
>
> Gr{oetje,eeting}s,
>
>                         Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 --
> geert@linux-m68k.org
>
> In personal conversations with technical people, I call myself a hacker.
> But
> when I'm talking to journalists I just say "programmer" or something like
> that.
>                                 -- Linus Torvalds
>

[-- Attachment #1.2: Type: text/html, Size: 3457 bytes --]

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5469 bytes --]