releases/4.4.45/qla2xxx-fix-crash-due-to-null-pointer-access.patch

   1 From fc1ffd6cb38a1c1af625b9833c41928039e733f5 Mon Sep 17 00:00:00 2001
   2 From: Quinn Tran <quinn.tran@cavium.com>
   3 Date: Fri, 23 Dec 2016 18:06:10 -0800
   4 Subject: qla2xxx: Fix crash due to null pointer access
   5
   6 From: Quinn Tran <quinn.tran@cavium.com>
   7
   8 commit fc1ffd6cb38a1c1af625b9833c41928039e733f5 upstream.
   9
  10 During code inspection, while investigating following stack trace
  11 seen on one of the test setup, we found out there was possibility
  12 of memory leak becuase driver was not unwinding the stack properly.
  13
  14 This issue has not been reproduced in a test environment or on a
  15 customer setup.
  16
  17 Here's stack trace that was seen.
  18
  19 [1469877.797315] Call Trace:
  20 [1469877.799940]  [<ffffffffa03ab6e9>] qla2x00_mem_alloc+0xb09/0x10c0 [qla2xxx]
  21 [1469877.806980]  [<ffffffffa03ac50a>] qla2x00_probe_one+0x86a/0x1b50 [qla2xxx]
  22 [1469877.814013]  [<ffffffff813b6d01>] ? __pm_runtime_resume+0x51/0xa0
  23 [1469877.820265]  [<ffffffff8157c1f5>] ? _raw_spin_lock_irqsave+0x25/0x90
  24 [1469877.826776]  [<ffffffff8157cd2d>] ? _raw_spin_unlock_irqrestore+0x6d/0x80
  25 [1469877.833720]  [<ffffffff810741d1>] ? preempt_count_sub+0xb1/0x100
  26 [1469877.839885]  [<ffffffff8157cd0c>] ? _raw_spin_unlock_irqrestore+0x4c/0x80
  27 [1469877.846830]  [<ffffffff81319b9c>] local_pci_probe+0x4c/0xb0
  28 [1469877.852562]  [<ffffffff810741d1>] ? preempt_count_sub+0xb1/0x100
  29 [1469877.858727]  [<ffffffff81319c89>] pci_call_probe+0x89/0xb0
  30
  31 Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
  32 Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
  33 Reviewed-by: Christoph Hellwig <hch@lst.de>
  34 [ bvanassche: Fixed spelling in patch description ]
  35 Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
  36 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  37
  38 ---
  39  drivers/scsi/qla2xxx/qla_os.c |   16 ++++++++++++----
  40  1 file changed, 12 insertions(+), 4 deletions(-)
  41
  42 --- a/drivers/scsi/qla2xxx/qla_os.c
  43 +++ b/drivers/scsi/qla2xxx/qla_os.c
  44 @@ -3365,7 +3365,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha
  45                                 sizeof(struct ct6_dsd), 0,
  46                                 SLAB_HWCACHE_ALIGN, NULL);
  47                         if (!ctx_cachep)
  48 -                               goto fail_free_gid_list;
  49 +                               goto fail_free_srb_mempool;
  50                 }
  51                 ha->ctx_mempool = mempool_create_slab_pool(SRB_MIN_REQ,
  52                         ctx_cachep);
  53 @@ -3518,7 +3518,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha
  54         ha->loop_id_map = kzalloc(BITS_TO_LONGS(LOOPID_MAP_SIZE) * sizeof(long),
  55             GFP_KERNEL);
  56         if (!ha->loop_id_map)
  57 -               goto fail_async_pd;
  58 +               goto fail_loop_id_map;
  59         else {
  60                 qla2x00_set_reserved_loop_ids(ha);
  61                 ql_dbg_pci(ql_dbg_init, ha->pdev, 0x0123,
  62 @@ -3527,6 +3527,8 @@ qla2x00_mem_alloc(struct qla_hw_data *ha
  63
  64         return 0;
  65
  66 +fail_loop_id_map:
  67 +       dma_pool_free(ha->s_dma_pool, ha->async_pd, ha->async_pd_dma);
  68  fail_async_pd:
  69         dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma);
  70  fail_ex_init_cb:
  71 @@ -3554,6 +3556,10 @@ fail_free_ms_iocb:
  72         dma_pool_free(ha->s_dma_pool, ha->ms_iocb, ha->ms_iocb_dma);
  73         ha->ms_iocb = NULL;
  74         ha->ms_iocb_dma = 0;
  75 +
  76 +       if (ha->sns_cmd)
  77 +               dma_free_coherent(&ha->pdev->dev, sizeof(struct sns_cmd_pkt),
  78 +                   ha->sns_cmd, ha->sns_cmd_dma);
  79  fail_dma_pool:
  80         if (IS_QLA82XX(ha) || ql2xenabledif) {
  81                 dma_pool_destroy(ha->fcp_cmnd_dma_pool);
  82 @@ -3571,10 +3577,12 @@ fail_free_nvram:
  83         kfree(ha->nvram);
  84         ha->nvram = NULL;
  85  fail_free_ctx_mempool:
  86 -       mempool_destroy(ha->ctx_mempool);
  87 +       if (ha->ctx_mempool)
  88 +               mempool_destroy(ha->ctx_mempool);
  89         ha->ctx_mempool = NULL;
  90  fail_free_srb_mempool:
  91 -       mempool_destroy(ha->srb_mempool);
  92 +       if (ha->srb_mempool)
  93 +               mempool_destroy(ha->srb_mempool);
  94         ha->srb_mempool = NULL;
  95  fail_free_gid_list:
  96         dma_free_coherent(&ha->pdev->dev, qla2x00_gid_list_size(ha),