lasi700_probe() obtains a SCSI host through NCR_700_detect(). The probe failure path drops the host reference with scsi_host_put(), but the normal remove path does not perform the corresponding cleanup. As a result, the SCSI host reference remains allocated after the driver is removed. Call scsi_host_put() after all users of the SCSI host have been torn down to release the reference acquired during probe. This issue was found by manual code inspection. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/scsi/lasi700.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/lasi700.c b/drivers/scsi/lasi700.c index 6d1fb55cc3ad..1b4982cde210 100644 --- a/drivers/scsi/lasi700.c +++ b/drivers/scsi/lasi700.c @@ -146,6 +146,7 @@ lasi700_driver_remove(struct parisc_device *dev) free_irq(host->irq, host); iounmap(hostdata->base); kfree(hostdata); + scsi_host_put(host); } static struct parisc_driver lasi700_driver __refdata = { -- 2.43.0