scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()

pqi_report_phys_luns() fails to release the rpl_list buffer when
encountering an unsupported data format or when the allocation for
rpl_16byte_wwid_list fails. These early returns bypass the cleanup logic,
leading to memory leaks.

Consolidate the error handling by adding an out_free_rpl_list label and use
goto statements to ensure rpl_list is consistently freed on failure.

Compile tested only. Issue found using a prototype static analysis tool and
code review.

Fixes: 28ca6d876c5a ("scsi: smartpqi: Add extended report physical LUNs")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Tested-by: Don Brace <don.brace@microchip.com>
Acked-by: Don Brace <don.brace@microchip.com>
Link: https://patch.msgid.link/20260131093641.1008117-1-zilin@seu.edu.cn
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 36834768fec1cedd89c52892f2fc1d7a86021099..6f859f0d2046051d443bf7135aee0fab515b2fa2 100644 (file)
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -1241,7 +1241,8 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b
                        dev_err(&ctrl_info->pci_dev->dev,
                                "RPL returned unsupported data format %u\n",
                                rpl_response_format);
-                       return -EINVAL;
+                       rc = -EINVAL;
+                       goto out_free_rpl_list;
                } else {
                        dev_warn(&ctrl_info->pci_dev->dev,
                                "RPL returned extended format 2 instead of 4\n");
@@ -1253,8 +1254,10 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b
 
        rpl_16byte_wwid_list = kmalloc(struct_size(rpl_16byte_wwid_list, lun_entries,
                                                   num_physicals), GFP_KERNEL);
-       if (!rpl_16byte_wwid_list)
-               return -ENOMEM;
+       if (!rpl_16byte_wwid_list) {
+               rc = -ENOMEM;
+               goto out_free_rpl_list;
+       }
 
        put_unaligned_be32(num_physicals * sizeof(struct report_phys_lun_16byte_wwid),
                &rpl_16byte_wwid_list->header.list_length);
@@ -1275,6 +1278,10 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b
        *buffer = rpl_16byte_wwid_list;
 
        return 0;
+
+out_free_rpl_list:
+       kfree(rpl_list);
+       return rc;
 }
 
 static inline int pqi_report_logical_luns(struct pqi_ctrl_info *ctrl_info, void **buffer)