Re: [PATCH] scsi: lpfc: Fix ndlp reference leak in lpfc_release_rpi()

[Paul Ely]

Thanks Wentao,
I need some time to read this one and test it.

Thanks

On Thu, Sep 17, 2026 at 10:48 AM Wentao Liang <vulab@xxxxxxxxxxx> wrote:
>
> lpfc_release_rpi() only drops the node reference and frees the mailbox
> memory it took when lpfc_sli_issue_mbox() returns MBX_NOT_FINISHED.  The
> SLI-4 issue path can also return -EIO without submitting the command, in
> which case the completion handler never runs and both are leaked.
>
> Clean up whenever the command was not handed to the port.
>
> Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>  drivers/scsi/lpfc/lpfc_nportdisc.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
> index 9c449055a55e..055f44ec7b94 100644
> --- a/drivers/scsi/lpfc/lpfc_nportdisc.c
> +++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
> @@ -1142,7 +1142,13 @@ lpfc_release_rpi(struct lpfc_hba *phba, struct lpfc_vport *vport,
>                                  ndlp->nlp_rpi, ndlp->nlp_DID, ndlp->nlp_flag);
>
>                 rc = lpfc_sli_issue_mbox(phba, pmb, MBX_NOWAIT);
> -               if (rc == MBX_NOT_FINISHED) {
> +
> +               /* Only a queued or completed command is handed to the
> +                * port; other results, such as the -EIO returned by the
> +                * SLI-4 path when it cannot submit a non-polled command,
> +                * leave the mailbox and the node reference to the caller.
> +                */
> +               if (rc != MBX_SUCCESS && rc != MBX_BUSY) {
>                         lpfc_nlp_put(ndlp);
>                         mempool_free(pmb, phba->mbox_mem_pool);
>                 }
> --
> 2.34.1
>

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature