Skip to contentSkip to conversation

mpi3mr: Add NULL checks when resetting request and reply queues

PATCH Applied Ranjan Kumar 2 participants 3 messages Feb 12 – Feb 24

Subsystems (2)
SCSI Broadcom MPI3 storage controller driver
lore
Share & tools
lore

Ranjan Kumar

author
#0 lore raw

PATCH 1/1 mpi3mr: Add NULL checks when resetting request and reply queues

The driver encountered a crash during resource cleanup
when the reply and request queues were null due to freed memory. This issue occurred when the creation of reply or request queues failed, and the driver freed the memory first but attempted to mem set the content of the freed memory, leading to a system crash.

Added null pointer checks for reply and request queues before accessing the reply/request memory during cleanup

Signed-off-by Ranjan Kumar <[email protected]>
---
 drivers/scsi/mpi3mr/mpi3mr_fw.c | 34 ++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +19 -15
index 1cfbdb773353..04d4a2aea7d7 100644
@@ -4806,21 +4806,25 @@ void mpi3mr_memset_buffers(struct mpi3mr_ioc *mrioc)
 	}
 
 	for (i = 0; i < mrioc->num_queues; i++) {
-		mrioc->op_reply_qinfo[i].qid = 0;
-		mrioc->op_reply_qinfo[i].ci = 0;
-		mrioc->op_reply_qinfo[i].num_replies = 0;
-		mrioc->op_reply_qinfo[i].ephase = 0;
-		atomic_set(&mrioc->op_reply_qinfo[i].pend_ios, 0);
-		atomic_set(&mrioc->op_reply_qinfo[i].in_use, 0);
-		mpi3mr_memset_op_reply_q_buffers(mrioc, i);
-
-		mrioc->req_qinfo[i].ci = 0;
-		mrioc->req_qinfo[i].pi = 0;
-		mrioc->req_qinfo[i].num_requests = 0;
-		mrioc->req_qinfo[i].qid = 0;
-		mrioc->req_qinfo[i].reply_qid = 0;
-		spin_lock_init(&mrioc->req_qinfo[i].q_lock);
-		mpi3mr_memset_op_req_q_buffers(mrioc, i);
+		if (mrioc->op_reply_qinfo) {
+			mrioc->op_reply_qinfo[i].qid = 0;
+			mrioc->op_reply_qinfo[i].ci = 0;
+			mrioc->op_reply_qinfo[i].num_replies = 0;
+			mrioc->op_reply_qinfo[i].ephase = 0;
+			atomic_set(&mrioc->op_reply_qinfo[i].pend_ios, 0);
+			atomic_set(&mrioc->op_reply_qinfo[i].in_use, 0);
+			mpi3mr_memset_op_reply_q_buffers(mrioc, i);
+		}
+
+		if (mrioc->req_qinfo) {
+			mrioc->req_qinfo[i].ci = 0;
+			mrioc->req_qinfo[i].pi = 0;
+			mrioc->req_qinfo[i].num_requests = 0;
+			mrioc->req_qinfo[i].qid = 0;
+			mrioc->req_qinfo[i].reply_qid = 0;
+			spin_lock_init(&mrioc->req_qinfo[i].q_lock);
+			mpi3mr_memset_op_req_q_buffers(mrioc, i);
+		}
 	}
 
 	atomic_set(&mrioc->pend_large_data_sz, 0);
Signature · 1 line
2.47.3
Applied
#1 lore raw

Ranjan,

Quoted 5 lines

The driver encountered a crash during resource cleanup when the reply and request queues were null due to freed memory. This issue occurred when the creation of reply or request queues failed, and the driver freed the memory first but attempted to mem set the content of the freed memory, leading to a system crash.

Applied to 7.0/scsi-staging, thanks!

Signature · 1 line
Martin K. Petersen
Applied
#2 lore raw
In reply to Ranjan Kumar
Quoted 10 lines · Ranjan Kumar

The driver encountered a crash during resource cleanup
when the reply and request queues were null due to freed memory. This issue occurred when the creation of reply or request queues failed, and the driver freed the memory first but attempted to mem set the content of the freed memory, leading to a system crash.

Added null pointer checks for reply and request queues before accessing the reply/request memory during cleanup

[...]

Applied to 7.0/scsi-fixes, thanks!

[1/1] mpi3mr: Add NULL checks when resetting request and reply queues

      https://git.kernel.org/mkp/scsi/c/fa96392ebebc
Signature · 1 line
Martin K. Petersen