mvme16x_probe() obtains a SCSI host through NCR_700_detect(). The
probe failure path drops the host reference with scsi_host_put(), but
the normal remove path does not perform the corresponding cleanup.
As a result, the SCSI host reference remains allocated after the
driver is removed.
Call scsi_host_put() after all users of the SCSI host have been torn
down to release the reference acquired during probe.
This issue was found by manual code inspection.
Fixes: 506c7bbcd9bc ("[SCSI] 53c700: m68k MVME16x NCR53C710 SCSI")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/scsi/mvme16x_scsi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/mvme16x_scsi.c b/drivers/scsi/mvme16x_scsi.c
index f4db93c13986..8191b1e273eb 100644
--- a/drivers/scsi/mvme16x_scsi.c
+++ b/drivers/scsi/mvme16x_scsi.c
@@ -120,6 +120,7 @@ static void mvme16x_device_remove(struct platform_device *dev)
NCR_700_release(host);
kfree(hostdata);
free_irq(host->irq, host);
+ scsi_host_put(host);
}
static struct platform_driver mvme16x_scsi_driver = {
--
2.43.0