initio_probe_one() allocates an SCB array and stores it in host->scb.
The probe failure paths free this array, but the normal remove path
does not perform the corresponding cleanup.

As a result, the SCB array remains allocated after the driver is
removed and becomes unreachable once the SCSI host is released.

Free the SCB array in initio_remove_one(), matching the probe error
path.

This issue was found by manual code inspection.

Fixes: 72d39fea9017 ("[SCSI] initio: Convert into a real Linux driver and update to modern style")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/scsi/initio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c
index 06fbe85dccfa..b373828bddf1 100644
--- a/drivers/scsi/initio.c
+++ b/drivers/scsi/initio.c
@@ -2934,6 +2934,7 @@ static void initio_remove_one(struct pci_dev *pdev)
 	struct initio_host *s = (struct initio_host *)host->hostdata;
 	scsi_remove_host(host);
 	free_irq(pdev->irq, host);
+	kfree(s->scb);
 	release_region(s->addr, 256);
 	scsi_host_put(host);
 	pci_disable_device(pdev);
-- 
2.43.0