From: Justin Tee justin.tee@broadcom.com
[ Upstream commit 803dfd83df33b7565f23aef597d5dd036adfa792 ]
lpfc_sli4_queue_setup() does not allocate memory and is used for submitting CREATE_QUEUE mailbox commands. Thus, if such mailbox commands fail we should clean up by also freeing the memory allocated for the queues with lpfc_sli4_queue_destroy(). Change the intended clean up label for the lpfc_sli4_queue_setup() error case to out_destroy_queue.
Signed-off-by: Justin Tee justin.tee@broadcom.com Message-ID: 20250915180811.137530-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen martin.petersen@oracle.com Signed-off-by: Sasha Levin sashal@kernel.org ---
LLM Generated explanations, may be completely bogus:
YES - The failure path after `lpfc_sli4_queue_setup()` now jumps to `out_destroy_queue` (`drivers/scsi/lpfc/lpfc_sli.c:8820`), guaranteeing that any queues allocated by `lpfc_sli4_queue_create()` are torn down before we bail out. - Those queues hold DMAable pages allocated in large batches (`drivers/scsi/lpfc/lpfc_init.c:10420`), so skipping `lpfc_sli4_queue_destroy()` leaked real memory whenever the mailbox CREATE_QUEUE commands failed—precisely the scenario this fix covers. - `out_destroy_queue` already performs the paired cleanup (`drivers/scsi/lpfc/lpfc_sli.c:9104`), invoking `lpfc_sli4_queue_destroy()` which handles partial setups and releases every queue resource (`drivers/scsi/lpfc/lpfc_init.c:10862`); we simply make sure the queue-setup error uses the same, already-tested path. - The change is tiny (one goto target), touches only the error path, and aligns this branch with other existing failures that already call `out_destroy_queue`, so regression risk is minimal while preventing a concrete resource leak on failed probe/recovery attempts.
drivers/scsi/lpfc/lpfc_sli.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index a8fbdf7119d88..d82ea9df098b8 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -8820,7 +8820,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) if (unlikely(rc)) { lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, "0381 Error %d during queue setup.\n", rc); - goto out_stop_timers; + goto out_destroy_queue; } /* Initialize the driver internal SLI layer lists. */ lpfc_sli4_setup(phba); @@ -9103,7 +9103,6 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) lpfc_free_iocb_list(phba); out_destroy_queue: lpfc_sli4_queue_destroy(phba); -out_stop_timers: lpfc_stop_hba_timers(phba); out_free_mbox: mempool_free(mboxq, phba->mbox_mem_pool);