[PATCH] nvme-fc: fix reference leak in nvme_fc_nvme_discovery_store()

[Laurence Oberman]

On Fri, 2026-10-23 at 19:30 +0530, Martin George wrote:
> nvme_fc_nvme_discovery_store() takes an lport and rport reference
> before
> checking whether the rport is already queued on the local discovery
> list. On the retry path (goto restart), rports that were queued in an
> earlier pass are skipped by the list_empty() check, but the
> references
> taken for them in the current pass are never dropped, leaking one
> lport
> and one rport reference per retry.
> 
> Check list_empty() first and only take references for rports that are
> actually added to the local discovery list.
> 
> Signed-off-by: Martin George <marting at netapp.com>
> ---
>  drivers/nvme/host/fc.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
> index 48454cb7a0fc..03f6fffc9574 100644
> --- a/drivers/nvme/host/fc.c
> +++ b/drivers/nvme/host/fc.c
> @@ -3778,6 +3778,9 @@ static ssize_t
> nvme_fc_nvme_discovery_store(struct device *dev,
>  restart:
>  	list_for_each_entry(lport, &nvme_fc_lport_list, port_list) {
>  		list_for_each_entry(rport, &lport->endp_list,
> endp_list) {
> +			/* skip rports already queued for discovery
> */
> +			if (!list_empty(&rport->disc_list))
> +				continue;
>  			if (!nvme_fc_lport_get(lport))
>  				continue;
>  			if (!nvme_fc_rport_get(rport)) {
> @@ -3799,9 +3802,7 @@ static ssize_t
> nvme_fc_nvme_discovery_store(struct device *dev,
>  				       "failures\n");
>  				goto process_local_list;
>  			}
> -			if (list_empty(&rport->disc_list))
> -				list_add_tail(&rport->disc_list,
> -					      &local_disc_list);
> +			list_add_tail(&rport->disc_list,
> &local_disc_list);
>  		}
>  	}
> 
>  
This looks good to me.
Reviewed-by: Laurence Oberman <loberman at redhat.com>