From: Weidong Wang fc_rport_enter_ready() takes a reference on the rport unconditionally, but only queues event_work, whose handler drops that reference, when no event is pending. If rdata->event is already set, the && short-circuits past both queue_work() and the compensating kref_put(), so the reference is leaked and the fc_rport_priv is never freed. This is reachable from the wire: a PLOGI from a well-known address goes straight to fc_rport_enter_ready(), and a second PLOGI for the same S_ID while RPORT_EV_READY is still pending enters it again. After the rport is logged out, kmemleak reports: unreferenced object 0xffff888... (size 512): backtrace: __kmalloc_noprof fc_rport_create fc_rport_recv_req fc_lport_recv_els_req fc_lport_recv fcoe_receive_work Commit 823a65409c89 ("scsi: libfc: Skip additional kref updating work event") fixed the same pattern in fc_rport_enter_delete(). Do the same here: only take the reference when no event is pending, i.e. when the work is actually going to be queued. The issue was found with an LLM-based bug-finding tool; the reproducer, fix and changelog were drafted with AI assistance (Claude), then reviewed and tested by the submitter. Fixes: 4d2095cc42a2 ("scsi: libfc: Revisit kref handling") Cc: stable@vger.kernel.org Signed-off-by: Weidong Wang --- Tested on v7.4-rc1 (05441d697f7f), x86_64, KASAN + kmemleak, QEMU/KVM. Reproducer: software FCoE instance on lo; raw FCoE ELS frames injected with AF_PACKET (PLOGI from well-known S_IDs 0xfffc01.., a second PLOGI for the same S_ID while RPORT_EV_READY is pending, then LOGO), 120 rports. 2nd enter_ready with kmemleak unreferenced event pending fc_rport_priv (512 B) unpatched 116 99 patched 104 0 READY/delete work events are processed the same with and without the patch; no KASAN/UBSAN/WARN splats. checkpatch clean, no new W=1 warnings. The reproducer can be shared on request. --- drivers/scsi/libfc/fc_rport.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c index c25979d96..7b0938544 100644 --- a/drivers/scsi/libfc/fc_rport.c +++ b/drivers/scsi/libfc/fc_rport.c @@ -550,10 +550,11 @@ static void fc_rport_enter_ready(struct fc_rport_priv *rdata) FC_RPORT_DBG(rdata, "Port is Ready\n"); - kref_get(&rdata->kref); - if (rdata->event == RPORT_EV_NONE && - !queue_work(rport_event_queue, &rdata->event_work)) - kref_put(&rdata->kref, fc_rport_destroy); + if (rdata->event == RPORT_EV_NONE) { + kref_get(&rdata->kref); + if (!queue_work(rport_event_queue, &rdata->event_work)) + kref_put(&rdata->kref, fc_rport_destroy); + } rdata->event = RPORT_EV_READY; } --- base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d change-id: 20261108-h123-send-723aeb555069 Best regards, -- Weidong Wang