lpfc_issue_ct_rsp() stores the reference returned by lpfc_nlp_get() in
dd_data so that the completion handler can drop it, but when lpfc_readl()
fails the function bails out to issue_ct_rsp_exit and frees dd_data
without dropping that reference, leaking the node.

Release the node on that error path too.

Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/scsi/lpfc/lpfc_bsg.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
index 7406dfa60016..f9e9896c348b 100644
--- a/drivers/scsi/lpfc/lpfc_bsg.c
+++ b/drivers/scsi/lpfc/lpfc_bsg.c
@@ -1545,6 +1545,7 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct bsg_job *job, uint32_t tag,
 	if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
 		if (lpfc_readl(phba->HCregaddr, &creg_val)) {
 			rc = -IOCB_ERROR;
+			lpfc_nlp_put(dd_data->context_un.iocb.ndlp);
 			goto issue_ct_rsp_exit;
 		}
 		creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
-- 
2.34.1

Hello Wentao,

Broadcom has already fixed this issue via an AI security scan.  We
plan to release the patchset very soon.

Thanks for finding it.

Paul


On Thu, Sep 17, 2026 at 10:42 AM Wentao Liang <vulab@iscas.ac.cn> wrote:
>
> lpfc_issue_ct_rsp() stores the reference returned by lpfc_nlp_get() in
> dd_data so that the completion handler can drop it, but when lpfc_readl()
> fails the function bails out to issue_ct_rsp_exit and frees dd_data
> without dropping that reference, leaking the node.
>
> Release the node on that error path too.
>
> Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/scsi/lpfc/lpfc_bsg.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
> index 7406dfa60016..f9e9896c348b 100644
> --- a/drivers/scsi/lpfc/lpfc_bsg.c
> +++ b/drivers/scsi/lpfc/lpfc_bsg.c
> @@ -1545,6 +1545,7 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct bsg_job *job, uint32_t tag,
>         if (phba->cfg_poll & DISABLE_FCP_RING_INT) {
>                 if (lpfc_readl(phba->HCregaddr, &creg_val)) {
>                         rc = -IOCB_ERROR;
> +                       lpfc_nlp_put(dd_data->context_un.iocb.ndlp);
>                         goto issue_ct_rsp_exit;
>                 }
>                 creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING);
> --
> 2.34.1
>