Commit b5f3bc39 authored by Quinn Tran's avatar Quinn Tran Committed by Martin K. Petersen
Browse files

scsi: qla2xxx: Fix inconsistent DMA mem alloc/free 



GPNFT command allocates 2 buffer for switch query. On completion, the same
buffers were freed using different size, instead of using original size at
the time of allocation.

This patch saves the size of the request and response buffers and uses that
to free them.

Following stack trace can be seen when using debug kernel

dump_stack+0x19/0x1b
__warn+0xd8/0x100
warn_slowpath_fmt+0x5f/0x80
check_unmap+0xfb/0xa20
debug_dma_free_coherent+0x110/0x160
qla24xx_sp_unmap+0x131/0x1e0 [qla2xxx]
qla24xx_async_gnnft_done+0xb6/0x550 [qla2xxx]
qla2x00_do_work+0x1ec/0x9f0 [qla2xxx]

Cc: <stable@vger.kernel.org> # v4.17+
Fixes: 33b28357 ("scsi: qla2xxx: Fix Async GPN_FT for FCP and FC-NVMe scan")
Reported-by: default avatarEwan D. Milne <emilne@redhat.com>
Signed-off-by: default avatarQuinn Tran <quinn.tran@cavium.com>
Signed-off-by: default avatarHimanshu Madhani <himanshu.madhani@cavium.com>
Signed-off-by: default avatarHimanshu Madhani <hmadhani@redhat.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 26b5b874

drivers/scsi/qla2xxx/qla_def.h

+2 −0
Original line number Diff line number Diff line
@@ -361,6 +361,8 @@ struct ct_arg { 
	dma_addr_t	rsp_dma;

	u32		req_size;

	u32		rsp_size;

	u32		req_allocated_size;

	u32		rsp_allocated_size;

	void		*req;

	void		*rsp;

	port_id_t	id;

drivers/scsi/qla2xxx/qla_gs.c

+26 −14
Original line number Diff line number Diff line
@@ -556,7 +556,7 @@ err2: 
		/* please ignore kernel warning. otherwise, we have mem leak. */

		if (sp->u.iocb_cmd.u.ctarg.req) {

			dma_free_coherent(&vha->hw->pdev->dev,

			    sizeof(struct ct_sns_pkt),

			    sp->u.iocb_cmd.u.ctarg.req_allocated_size,

			    sp->u.iocb_cmd.u.ctarg.req,

			    sp->u.iocb_cmd.u.ctarg.req_dma);

			sp->u.iocb_cmd.u.ctarg.req = NULL;
@@ -564,7 +564,7 @@ err2: 


		if (sp->u.iocb_cmd.u.ctarg.rsp) {

			dma_free_coherent(&vha->hw->pdev->dev,

			    sizeof(struct ct_sns_pkt),

			    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,

			    sp->u.iocb_cmd.u.ctarg.rsp,

			    sp->u.iocb_cmd.u.ctarg.rsp_dma);

			sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -617,6 +617,7 @@ static int qla_async_rftid(scsi_qla_host_t *vha, port_id_t *d_id) 
	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,

	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,

	    GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.req) {

		ql_log(ql_log_warn, vha, 0xd041,

		    "%s: Failed to allocate ct_sns request.\n",
@@ -627,6 +628,7 @@ static int qla_async_rftid(scsi_qla_host_t *vha, port_id_t *d_id) 
	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,

	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,

	    GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.rsp) {

		ql_log(ql_log_warn, vha, 0xd042,

		    "%s: Failed to allocate ct_sns request.\n",
@@ -712,6 +714,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, 
	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,

	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,

	    GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.req) {

		ql_log(ql_log_warn, vha, 0xd041,

		    "%s: Failed to allocate ct_sns request.\n",
@@ -722,6 +725,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, 
	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,

	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,

	    GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.rsp) {

		ql_log(ql_log_warn, vha, 0xd042,

		    "%s: Failed to allocate ct_sns request.\n",
@@ -802,6 +806,7 @@ static int qla_async_rnnid(scsi_qla_host_t *vha, port_id_t *d_id, 
	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,

	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,

	    GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.req) {

		ql_log(ql_log_warn, vha, 0xd041,

		    "%s: Failed to allocate ct_sns request.\n",
@@ -812,6 +817,7 @@ static int qla_async_rnnid(scsi_qla_host_t *vha, port_id_t *d_id, 
	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,

	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,

	    GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.rsp) {

		ql_log(ql_log_warn, vha, 0xd042,

		    "%s: Failed to allocate ct_sns request.\n",
@@ -909,6 +915,7 @@ static int qla_async_rsnn_nn(scsi_qla_host_t *vha) 
	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,

	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,

	    GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.req) {

		ql_log(ql_log_warn, vha, 0xd041,

		    "%s: Failed to allocate ct_sns request.\n",
@@ -919,6 +926,7 @@ static int qla_async_rsnn_nn(scsi_qla_host_t *vha) 
	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,

	    sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,

	    GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.rsp) {

		ql_log(ql_log_warn, vha, 0xd042,

		    "%s: Failed to allocate ct_sns request.\n",
@@ -3388,14 +3396,14 @@ void qla24xx_sp_unmap(scsi_qla_host_t *vha, srb_t *sp) 
{

	if (sp->u.iocb_cmd.u.ctarg.req) {

		dma_free_coherent(&vha->hw->pdev->dev,

			sizeof(struct ct_sns_pkt),

			sp->u.iocb_cmd.u.ctarg.req_allocated_size,

			sp->u.iocb_cmd.u.ctarg.req,

			sp->u.iocb_cmd.u.ctarg.req_dma);

		sp->u.iocb_cmd.u.ctarg.req = NULL;

	}

	if (sp->u.iocb_cmd.u.ctarg.rsp) {

		dma_free_coherent(&vha->hw->pdev->dev,

			sizeof(struct ct_sns_pkt),

			sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,

			sp->u.iocb_cmd.u.ctarg.rsp,

			sp->u.iocb_cmd.u.ctarg.rsp_dma);

		sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -3596,14 +3604,14 @@ static void qla2x00_async_gpnid_sp_done(void *s, int res) 
		/* please ignore kernel warning. otherwise, we have mem leak. */

		if (sp->u.iocb_cmd.u.ctarg.req) {

			dma_free_coherent(&vha->hw->pdev->dev,

				sizeof(struct ct_sns_pkt),

				sp->u.iocb_cmd.u.ctarg.req_allocated_size,

				sp->u.iocb_cmd.u.ctarg.req,

				sp->u.iocb_cmd.u.ctarg.req_dma);

			sp->u.iocb_cmd.u.ctarg.req = NULL;

		}

		if (sp->u.iocb_cmd.u.ctarg.rsp) {

			dma_free_coherent(&vha->hw->pdev->dev,

				sizeof(struct ct_sns_pkt),

				sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,

				sp->u.iocb_cmd.u.ctarg.rsp,

				sp->u.iocb_cmd.u.ctarg.rsp_dma);

			sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -3654,6 +3662,7 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id) 
	sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev,

		sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma,

		GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.req) {

		ql_log(ql_log_warn, vha, 0xd041,

		    "Failed to allocate ct_sns request.\n");
@@ -3663,6 +3672,7 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id) 
	sp->u.iocb_cmd.u.ctarg.rsp = dma_alloc_coherent(&vha->hw->pdev->dev,

		sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.rsp_dma,

		GFP_KERNEL);

	sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);

	if (!sp->u.iocb_cmd.u.ctarg.rsp) {

		ql_log(ql_log_warn, vha, 0xd042,

		    "Failed to allocate ct_sns request.\n");
@@ -4142,14 +4152,14 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res) 
			 */

			if (sp->u.iocb_cmd.u.ctarg.req) {

				dma_free_coherent(&vha->hw->pdev->dev,

				    sizeof(struct ct_sns_pkt),

				    sp->u.iocb_cmd.u.ctarg.req_allocated_size,

				    sp->u.iocb_cmd.u.ctarg.req,

				    sp->u.iocb_cmd.u.ctarg.req_dma);

				sp->u.iocb_cmd.u.ctarg.req = NULL;

			}

			if (sp->u.iocb_cmd.u.ctarg.rsp) {

				dma_free_coherent(&vha->hw->pdev->dev,

				    sizeof(struct ct_sns_pkt),

				    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,

				    sp->u.iocb_cmd.u.ctarg.rsp,

				    sp->u.iocb_cmd.u.ctarg.rsp_dma);

				sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4179,14 +4189,14 @@ static void qla2x00_async_gpnft_gnnft_sp_done(void *s, int res) 
		/* please ignore kernel warning. Otherwise, we have mem leak. */

		if (sp->u.iocb_cmd.u.ctarg.req) {

			dma_free_coherent(&vha->hw->pdev->dev,

			    sizeof(struct ct_sns_pkt),

			    sp->u.iocb_cmd.u.ctarg.req_allocated_size,

			    sp->u.iocb_cmd.u.ctarg.req,

			    sp->u.iocb_cmd.u.ctarg.req_dma);

			sp->u.iocb_cmd.u.ctarg.req = NULL;

		}

		if (sp->u.iocb_cmd.u.ctarg.rsp) {

			dma_free_coherent(&vha->hw->pdev->dev,

			    sizeof(struct ct_sns_pkt),

			    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,

			    sp->u.iocb_cmd.u.ctarg.rsp,

			    sp->u.iocb_cmd.u.ctarg.rsp_dma);

			sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4281,14 +4291,14 @@ static int qla24xx_async_gnnft(scsi_qla_host_t *vha, struct srb *sp, 
done_free_sp:

	if (sp->u.iocb_cmd.u.ctarg.req) {

		dma_free_coherent(&vha->hw->pdev->dev,

		    sizeof(struct ct_sns_pkt),

		    sp->u.iocb_cmd.u.ctarg.req_allocated_size,

		    sp->u.iocb_cmd.u.ctarg.req,

		    sp->u.iocb_cmd.u.ctarg.req_dma);

		sp->u.iocb_cmd.u.ctarg.req = NULL;

	}

	if (sp->u.iocb_cmd.u.ctarg.rsp) {

		dma_free_coherent(&vha->hw->pdev->dev,

		    sizeof(struct ct_sns_pkt),

		    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,

		    sp->u.iocb_cmd.u.ctarg.rsp,

		    sp->u.iocb_cmd.u.ctarg.rsp_dma);

		sp->u.iocb_cmd.u.ctarg.rsp = NULL;
@@ -4349,6 +4359,7 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp) 
		sp->u.iocb_cmd.u.ctarg.req = dma_zalloc_coherent(

			&vha->hw->pdev->dev, sizeof(struct ct_sns_pkt),

			&sp->u.iocb_cmd.u.ctarg.req_dma, GFP_KERNEL);

		sp->u.iocb_cmd.u.ctarg.req_allocated_size = sizeof(struct ct_sns_pkt);

		if (!sp->u.iocb_cmd.u.ctarg.req) {

			ql_log(ql_log_warn, vha, 0xffff,

			    "Failed to allocate ct_sns request.\n");
@@ -4366,6 +4377,7 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp) 
		sp->u.iocb_cmd.u.ctarg.rsp = dma_zalloc_coherent(

			&vha->hw->pdev->dev, rspsz,

			&sp->u.iocb_cmd.u.ctarg.rsp_dma, GFP_KERNEL);

		sp->u.iocb_cmd.u.ctarg.rsp_allocated_size = sizeof(struct ct_sns_pkt);

		if (!sp->u.iocb_cmd.u.ctarg.rsp) {

			ql_log(ql_log_warn, vha, 0xffff,

			    "Failed to allocate ct_sns request.\n");
@@ -4425,14 +4437,14 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp) 
done_free_sp:

	if (sp->u.iocb_cmd.u.ctarg.req) {

		dma_free_coherent(&vha->hw->pdev->dev,

		    sizeof(struct ct_sns_pkt),

		    sp->u.iocb_cmd.u.ctarg.req_allocated_size,

		    sp->u.iocb_cmd.u.ctarg.req,

		    sp->u.iocb_cmd.u.ctarg.req_dma);

		sp->u.iocb_cmd.u.ctarg.req = NULL;

	}

	if (sp->u.iocb_cmd.u.ctarg.rsp) {

		dma_free_coherent(&vha->hw->pdev->dev,

		    sizeof(struct ct_sns_pkt),

		    sp->u.iocb_cmd.u.ctarg.rsp_allocated_size,

		    sp->u.iocb_cmd.u.ctarg.rsp,

		    sp->u.iocb_cmd.u.ctarg.rsp_dma);

		sp->u.iocb_cmd.u.ctarg.rsp = NULL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE