From a563f13a54efb5662627743ef56b3d5f87ef6045 Mon Sep 17 00:00:00 2001 From: Martin George Date: Fri, 23 Oct 2026 19:30:57 +0530 Subject: [PATCH] nvme-fc: fix reference leak in nvme_fc_nvme_discovery_store() nvme_fc_nvme_discovery_store() takes an lport and rport reference before checking whether the rport is already queued on the local discovery list. On the retry path (goto restart), rports that were queued in an earlier pass are skipped by the list_empty() check, but the references taken for them in the current pass are never dropped, leaking one lport and one rport reference per retry. Check list_empty() first and only take references for rports that are actually added to the local discovery list. Reviewed-by: Laurence Oberman Signed-off-by: Martin George Signed-off-by: Keith Busch --- drivers/nvme/host/fc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index 48454cb7a0fc..03f6fffc9574 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -3778,6 +3778,9 @@ static ssize_t nvme_fc_nvme_discovery_store(struct device *dev, restart: list_for_each_entry(lport, &nvme_fc_lport_list, port_list) { list_for_each_entry(rport, &lport->endp_list, endp_list) { + /* skip rports already queued for discovery */ + if (!list_empty(&rport->disc_list)) + continue; if (!nvme_fc_lport_get(lport)) continue; if (!nvme_fc_rport_get(rport)) { @@ -3799,9 +3802,7 @@ static ssize_t nvme_fc_nvme_discovery_store(struct device *dev, "failures\n"); goto process_local_list; } - if (list_empty(&rport->disc_list)) - list_add_tail(&rport->disc_list, - &local_disc_list); + list_add_tail(&rport->disc_list, &local_disc_list); } }