mpt3sas_base_attach() tears memory pools down from its
out_free_resources path when _base_allocate_memory_pools() fails.
Some _base_allocate_memory_pools() retry and error paths already call
_base_release_memory_pools() before returning an error, so the attach
cleanup can run the same teardown twice.

Set reply_post, pcie_sgl_dma_pool, and config_page to NULL after
teardown so the attach failure path cannot release the same resources a
second time, avoiding a double free.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc4.

Runtime validation was not attempted because this path depends on
mpt3sas controller initialization and suitable hardware or firmware.

Fixes: 8ff045c92708 ("mpt3sas: Free memory pools before retrying to allocate with different value.")
Cc: stable@vger.kernel.org
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 79052f2accbd..18fe64d6f40a 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -5866,6 +5866,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
 		}
 		dma_pool_destroy(ioc->reply_post_free_array_dma_pool);
 		kfree(ioc->reply_post);
+		ioc->reply_post = NULL;
 	}
 
 	if (ioc->pcie_sgl_dma_pool) {
@@ -5876,6 +5877,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
 			ioc->pcie_sg_lookup[i].pcie_sgl = NULL;
 		}
 		dma_pool_destroy(ioc->pcie_sgl_dma_pool);
+		ioc->pcie_sgl_dma_pool = NULL;
 	}
 	kfree(ioc->pcie_sg_lookup);
 	ioc->pcie_sg_lookup = NULL;
@@ -5886,6 +5888,7 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc)
 				     ioc->config_page));
 		dma_free_coherent(&ioc->pdev->dev, ioc->config_page_sz,
 		    ioc->config_page, ioc->config_page_dma);
+		ioc->config_page = NULL;
 	}
 
 	kfree(ioc->hpr_lookup);
-- 
2.34.1