UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

scsi: qla2xxx: Fix memory leak for allocating abort IOCB 

In the case of IOCB QFull, Initiator code can leave behind a stale pointer
to an SRB structure on the outstanding command array.

Fixes: 82de802ad4 ("scsi: qla2xxx: Preparation for Target MQ.")
Cc: stable@vger.kernel.org #v4.16+
Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Quinn Tran 2018-07-26 16:34:44 -07:00 committed by Martin K. Petersen
parent b4146c4929
commit 5e53be8e47
1 changed files with 27 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
drivers/scsi/qla2xxx/qla_iocb.c
View File

@ -2130,34 +2130,11 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp)
req_cnt = 1; req_cnt = 1;
handle = 0; handle = 0;
if (!sp) if (sp && (sp->type != SRB_SCSI_CMD)) {
goto skip_cmd_array; /* Adjust entry-counts as needed. */
/* Check for room in outstanding command list. */
handle = req->current_outstanding_cmd;
for (index = 1; index < req->num_outstanding_cmds; index++) {
handle++;
if (handle == req->num_outstanding_cmds)
handle = 1;
if (!req->outstanding_cmds[handle])
break;
}
if (index == req->num_outstanding_cmds) {
ql_log(ql_log_warn, vha, 0x700b,
"No room on outstanding cmd array.\n");
goto queuing_error;
}
/* Prep command array. */
req->current_outstanding_cmd = handle;
req->outstanding_cmds[handle] = sp;
sp->handle = handle;
/* Adjust entry-counts as needed. */
if (sp->type != SRB_SCSI_CMD)
req_cnt = sp->iocbs; req_cnt = sp->iocbs;
}
skip_cmd_array:
/* Check for room on request queue. */ /* Check for room on request queue. */
if (req->cnt < req_cnt + 2) { if (req->cnt < req_cnt + 2) {
if (qpair->use_shadow_reg) if (qpair->use_shadow_reg)
@ -2183,6 +2160,28 @@ skip_cmd_array:
if (req->cnt < req_cnt + 2) if (req->cnt < req_cnt + 2)
goto queuing_error; goto queuing_error;
if (sp) {
/* Check for room in outstanding command list. */
handle = req->current_outstanding_cmd;
for (index = 1; index < req->num_outstanding_cmds; index++) {
handle++;
if (handle == req->num_outstanding_cmds)
handle = 1;
if (!req->outstanding_cmds[handle])
break;
}
if (index == req->num_outstanding_cmds) {
ql_log(ql_log_warn, vha, 0x700b,
"No room on outstanding cmd array.\n");
goto queuing_error;
}
/* Prep command array. */
req->current_outstanding_cmd = handle;
req->outstanding_cmds[handle] = sp;
sp->handle = handle;
}
/* Prep packet */ /* Prep packet */
req->cnt -= req_cnt; req->cnt -= req_cnt;
pkt = req->ring_ptr; pkt = req->ring_ptr;
@ -2195,6 +2194,8 @@ skip_cmd_array:
pkt->handle = handle; pkt->handle = handle;
} }
return pkt;
queuing_error: queuing_error:
qpair->tgt_counters.num_alloc_iocb_failed++; qpair->tgt_counters.num_alloc_iocb_failed++;
return pkt; return pkt;