Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

scsi: core: Fix error handling for scsi_alloc_sdev()

After scsi_sysfs_device_initialize() was called, error paths must call
__scsi_remove_device().

Fixes: 1ac22c8eae81 ("scsi: core: Fix refcount leak for tagset_refcnt")
Cc: stable@vger.kernel.org
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260304164603.51528-1-junxiao.bi@oracle.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

authored by

Junxiao Bi and committed by
Martin K. Petersen
4ce7ada4 14d4ac19

+2 -6
+2 -6
drivers/scsi/scsi_scan.c
··· 360 360 * default device queue depth to figure out sbitmap shift 361 361 * since we use this queue depth most of times. 362 362 */ 363 - if (scsi_realloc_sdev_budget_map(sdev, depth)) { 364 - kref_put(&sdev->host->tagset_refcnt, scsi_mq_free_tags); 365 - put_device(&starget->dev); 366 - kfree(sdev); 367 - goto out; 368 - } 363 + if (scsi_realloc_sdev_budget_map(sdev, depth)) 364 + goto out_device_destroy; 369 365 370 366 scsi_change_queue_depth(sdev, depth); 371 367