From nobody Fri Sep 25 02:06:47 2026 Received: from cstnet.cn (smtp25.cstnet.cn [159.226.251.25]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8F8C4E73C7; Thu, 17 Sep 2026 15:12:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.25 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789657985; cv=none; b=EOk0NhLYrTfsHqgeNmOR493tv9djuA4usYtV64MUFTKMdV+LtF252tOVX65qbZruOjpwthagH1Bk1q8wAiR+cRQM8eQevyQCFehWYd06DQUaJUvWokWTt4HZF0UzdPej9UF5PvTIbnoF6KvO45diIgKum9dW7T2SgMWsjjkKYjA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789657985; c=relaxed/simple; bh=6p3gKvGXubWNvqcEvvNLR+vxK1mo1LbFSfvspunoQTg=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=fAR2pVAPjkGoZdvOS/Whz3b28MP5twRK7fBhq5m06MhwirW2GQ9Bp5LSihAgHmJTJRYrGy6F3gp3lQdCQo/qAPYiK/gJP32FsDgcHyhKzjEOKCfG6IJ1Ffxg+HOi9soJdCYshZ62qX1LtLdpQITL7CllJLZ5LW4sekF6oiAbUZM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from dfae2b116770.home.arpa (unknown [36.110.52.2]) by APP-05 (Coremail) with SMTP id zQCowABXwz1wA6xq40iDCA--.46537S2; Thu, 17 Sep 2026 23:12:48 +0800 (CST) From: Wentao Liang To: James.Bottomley@HansenPartnership.com Cc: MPT-FusionLinux.pdl@broadcom.com, linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org, martin.petersen@oracle.com, ranjan.kumar@broadcom.com, sathya.prakash@broadcom.com, sreekanth.reddy@broadcom.com, suganath-prabu.subramani@broadcom.com, Wentao Liang Subject: [PATCH] scsi: mpt3sas: Fix pcie_device reference leak in _scsih_ublock_io_device_wait() Date: Thu, 17 Sep 2026 15:12:48 +0000 Message-Id: <20260917151248.2158493-1-vulab@iscas.ac.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zQCowABXwz1wA6xq40iDCA--.46537S2 X-Coremail-Antispam: 1UD129KBjvJXoW7KFy5XF4rWF43GryUXw48tFb_yoW8WFy5pF WkCa4YyFyDGr4Ig3W7uw4Uury5AasIkr95tF40qa4I9ws5JFyFyr92krZ8J3WUJFZ3ta98 XrnrJr93CFW5JrJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUPvb7Iv0xC_Kw4lb4IE77IF4wAFc2x0x2IEx4CE42xK8VAvwI8I cIk0rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2 AK021l84ACjcxK6xIIjxv20xvE14v26ryj6F1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v2 6r4UJVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI 0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2Wl Yx0E2Ix0cI8IcVAFwI0_Jw0_WrylYx0Ex4A2jsIE14v26F4UJVW0owAm72CE4IkC6x0Yz7 v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0E0s8F02x267IIx4CEVc8vx2IErcIFxwAC I402YVCY1x02628vn2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrw CF04k20xvE74AGY7Cv6cx26r48ZrWUJr1UMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E 5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUtV W8ZwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1I6r4UMIIF0xvE2Ix0cI8IcVCY 1x0267AKxVWxJVW8Jr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14 v26r4UJVWxJr1lIxAIcVC2z280aVCY1x0267AKxVW0oVCq3bIYCTnIWIevJa73UjIFyTuY vjxUDdgADUUUU X-CM-SenderInfo: pyxotu46lvutnvoduhdfq/1tbiBwYNA2qr9tgevQAAsD Content-Type: text/plain; charset="utf-8" The reference taken by mpt3sas_get_pdev_by_handle() is only dropped at the bottom of the retry loop. When the device is not ready the loop takes the continue before that point, so the reference is leaked on every retry. Drop the reference right after the reset parameters have been read, so it is always released once per iteration. Fixes: aee682fad6cd ("scsi: mpt3sas: Improve device discovery and readiness= handling for slow devices") Signed-off-by: Wentao Liang --- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mp= t3sas_scsih.c index 12caffeed3a0..c841fe1706c7 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c @@ -4093,6 +4093,8 @@ _scsih_ublock_io_device_wait(struct MPT3SAS_ADAPTER *= ioc, u64 sas_address, tr_timeout =3D pcie_device->reset_timeout; tr_method =3D MPI26_SCSITASKMGMT_MSGFLAGS_PROTOCOL_LVL_RST_PCIE; } + if (pcie_device) + pcie_device_put(pcie_device); rc =3D _scsih_wait_for_device_to_become_ready(ioc, sas_target->handle, 0, (sas_target->flags & MPT_TARGET_FLAGS_RAID_COMPONENT), sdev->lun, tr_timeout, tr_metho= d); @@ -4114,8 +4116,6 @@ _scsih_ublock_io_device_wait(struct MPT3SAS_ADAPTER *= ioc, u64 sas_address, } continue; } - if (pcie_device) - pcie_device_put(pcie_device); } while ((rc =3D=3D DEVICE_RETRY || rc =3D=3D DEVICE_START_UNIT || rc =3D=3D DEVICE_STOP_UNIT || rc =3D=3D DEVICE_RETRY_UA) && count++ <=3D command_retry_count); --=20 2.34.1