scsi: elx: libefc: fix resources leak in efcport_init() error path

PATCH Applied Haotian Zhang 5 participants 6 messages Oct 8 – Oct 29

Subsystems (3)

SCSI SCSI target Emulex/Broadcom efct FC/FCoE SCSI target driver

lore

Share & tools

lore

Haotian Zhang

author

2026-10-08 18:54 UTC #0 lore raw

PATCH 1/1 scsi: elx: libefc: fix resources leak in efcport_init() error path

efcport_init() creates efc->node_pool and efc->node_dma_pool before allocating efc->els_io_pool. When the latter allocation fails it returns -ENOMEM without releasing the node dma pool or the node pool, leaking both. The caller efct_efclib_config() only logs the error and efct_device_attach() failure path never calls efcport_destroy(), so the resources are never freed.

Destroy node_dma_pool and node_pool before returning from the els_io_pool allocation failure path.

Fixes d7b71fd2195e ("scsi: elx: libefc: Emulex FC discovery library APIs and definitions")

Assisted-by DeepSeek-V4.1-Flash

Signed-off-by Haotian Zhang <[email protected]>

---
 drivers/scsi/elx/libefc/efclib.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/scsi/elx/libefc/efclib.c +2 -0

index dd3e3d0a4761..ceec0e2a0266 100644
@@ -50,6 +50,8 @@ int efcport_init(struct efc *efc)
 						sizeof(struct efc_els_io_req));
 	if (!efc->els_io_pool) {
 		efc_log_err(efc, "Can't allocate els io pool\n");
+		dma_pool_destroy(efc->node_dma_pool);
+		mempool_destroy(efc->node_pool);
 		return -ENOMEM;
 	}

Signature · 1 line

2.25.1

[email protected]

AI review

2026-10-08 19:04 UTC #1 lore raw

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] scsi: elx: memory leak of efc struct in efct_efclib_config() error path --

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] scsi: elx: memory leak of efc struct in efct_efclib_config() error path --

commit f7137ee0f9986ee6fc40d031e1433afbe8aa395a
Author: Haotian Zhang <[email protected]>

scsi: elx: libefc: fix resources leak in efcport_init() error path

drivers/scsi/elx/libefc/efclib.c int efcport_init(struct efc *efc) · line 55

Quoted 11 lines

drivers/scsi/elx/libefc/efclib.c +2 -0

index dd3e3d0a47614..ceec0e2a0266a 100644
@@ -50,6 +50,8 @@ int efcport_init(struct efc *efc)
 						sizeof(struct efc_els_io_req));
 	if (!efc->els_io_pool) {
 		efc_log_err(efc, "Can't allocate els io pool\n");
+		dma_pool_destroy(efc->node_dma_pool);
+		mempool_destroy(efc->node_pool);
 		return -ENOMEM;

[Severity: Medium]
Does returning an error here result in leaking the efc struct itself?

In drivers/scsi/elx/efct/efct_driver.c:efct_efclib_config(), the efc struct is dynamically allocated and attached to efct->efcport:

	efc = kzalloc_obj(*efc);
	if (!efc)
		return -ENOMEM;

	efct->efcport = efc;

When efcport_init() fails, it returns the error without freeing the efc struct:

	rc = efcport_init(efc);
	if (rc)
		efc_log_err(efc, "efcport_init failed\n");

	return rc;

The error handler in efct_device_attach() also skips freeing efct->efcport or calling efcport_destroy():

efclib_out:

	efct_xport_detach(efct->xport);
xport_out:
	efct_xport_free(efct->xport);
	efct->xport = NULL;
out:
	return rc;

Does this leave the efc struct permanently leaked?

Quoted 2 lines

drivers/scsi/elx/libefc/efclib.c +0 -0
 	}
 

Signature · 1 line

Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1

Krzysztof Kozlowski

2026-10-09 06:10 UTC #2 lore raw

In reply to Haotian Zhang

Quoted 10 lines · Haotian Zhang

efcport_init() creates efc->node_pool and efc->node_dma_pool before allocating efc->els_io_pool. When the latter allocation fails it returns -ENOMEM without releasing the node dma pool or the node pool, leaking both. The caller efct_efclib_config() only logs the error and efct_device_attach() failure path never calls efcport_destroy(), so the resources are never freed.
Destroy node_dma_pool and node_pool before returning from the els_io_pool allocation failure path.

Quoted 7 lines

Fixes d7b71fd2195e ("scsi: elx: libefc: Emulex FC discovery library APIs and definitions")
Assisted-by DeepSeek-V4.1-Flash
Signed-off-by Haotian Zhang <[email protected]>
---
 drivers/scsi/elx/libefc/efclib.c | 2 ++
 1 file changed, 2 insertions(+)

Multiple things here:
1. Your team ignored completely previous feedback.

2. You use multiple identities with this email, thus I actually doubt we speak with actual person.

3. Finally, same feedback:
You sent multiple independent patches, to multiple independent subsystems. The amount of these patches clearly suggest this was AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing relevant patches into patchsets. This makes reviewing difficult and might cause multiple reviewers to address the same issue. Replying to the entire set is impossible and requires handling each patch independently, instead of applying or discarding the set. Maintainers also won't see the bigger picture of your work. Quite worrying.

This is on the verge of hostile patch: bomb us with so many contributions, we won't be able to handle them in efficient manner, like responding ONCE to ask you to slow down. Considering all this is untested and LLM generated, I have even more doubts whether this should be considered for review.

Please read kernel documentation BEFORE posting more work. It will explain you how to identify subsystems, how to organize your work per subsystem (so a patchset grouping multiple patches with a short cover letter), how to document usage of LLM and how what you should not do if this was posted in a good faith.

Best regards,
Krzysztof

Daniel Wagner

Reviewed-by on v1 1/1

2026-10-12 09:36 UTC #3 lore raw

In reply to Haotian Zhang

Quoted 7 lines · Haotian Zhang

efcport_init() creates efc->node_pool and efc->node_dma_pool before allocating efc->els_io_pool. When the latter allocation fails it returns -ENOMEM without releasing the node dma pool or the node pool, leaking both. The caller efct_efclib_config() only logs the error and efct_device_attach() failure path never calls efcport_destroy(), so the resources are never freed.

Quoted 6 lines

Destroy node_dma_pool and node_pool before returning from the els_io_pool allocation failure path.
Fixes d7b71fd2195e ("scsi: elx: libefc: Emulex FC discovery library APIs and definitions")
Assisted-by DeepSeek-V4.1-Flash
Signed-off-by Haotian Zhang <[email protected]>

Patch looks correct.

I didn't follow your other submission and this fix here is simple enough, so I don't mind it.

Though, I see Krzysztof's response and thus you should not take my Reviewed by tag here as free ticket to overload other maintainers. Please follow our community guidelines.

Reviewed-by Daniel Wagner <[email protected]>

Martin K. Petersen

maintainer Applied

2026-10-24 02:22 UTC #4 lore raw

In reply to Haotian Zhang

Haotian,

Quoted 6 lines

efcport_init() creates efc->node_pool and efc->node_dma_pool before allocating efc->els_io_pool. When the latter allocation fails it returns -ENOMEM without releasing the node dma pool or the node pool, leaking both. The caller efct_efclib_config() only logs the error and efct_device_attach() failure path never calls efcport_destroy(), so the resources are never freed.

Applied to 7.4/scsi-staging, thanks!

Signature · 1 line

Martin K. Petersen

Martin K. Petersen (Oracle)

maintainer Applied

2026-10-29 02:03 UTC #5 lore raw

In reply to Haotian Zhang

Quoted 8 lines · Haotian Zhang

efcport_init() creates efc->node_pool and efc->node_dma_pool before allocating efc->els_io_pool. When the latter allocation fails it returns -ENOMEM without releasing the node dma pool or the node pool, leaking both. The caller efct_efclib_config() only logs the error and efct_device_attach() failure path never calls efcport_destroy(), so the resources are never freed.
[...]

Applied to 7.4/scsi-queue, thanks!

[1/1] scsi: elx: libefc: fix resources leak in efcport_init() error path

      https://git.kernel.org/mkp/scsi/c/b4bd078b78c2

Signature · 1 line

Martin K. Petersen