[PATCH] scsi: lpfc: fix ioremap issues in 'lpfc_sli4_pci_mem_setup'

[PATCH] scsi: lpfc: fix ioremap issues in 'lpfc_sli4_pci_mem_setup'

[lishuchang]

From: Shuchang Li <lishuchang@hust.edu.cn>

When if_type equals to zero and pci_resource_start(pdev, PCI_64BIT_BAR4)
returns false, drbl_regs_memmap_p is not remapped. However, in the code
it goes to out_iounmap_all, where drbl_regs_memmap_p is unmapped. This
may cause some problems.

When if_type equals to six and pci_resource_start(pdev, PCI_64BIT_BAR4)
returns true, drbl_regs_memmap_p may has been remapped and
ctrl_regs_memmap_p is not remapped. However in the code it goes to
out_iounmap_ctrl, where ctrl_regs_memmap_p is unmapped and
drbl_regs_memmap_p is not unmapped. This may cause a leak and
some other problems.

To fix these issues, we need to add null checks before iounmap(), and
change some goto lables.

Signed-off-by: Shuchang Li <lishuchang@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
---
 drivers/scsi/lpfc/lpfc_init.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 4f7485958c49..bd5e734487e3 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -12026,7 +12026,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
 				goto out_iounmap_all;
 		} else {
 			error = -ENOMEM;
-			goto out_iounmap_all;
+			goto out_iounmap_ctrl;
 		}
 	}
 
@@ -12044,7 +12044,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
 			dev_err(&pdev->dev,
 			   "ioremap failed for SLI4 HBA dpp registers.\n");
 			error = -ENOMEM;
-			goto out_iounmap_ctrl;
+			goto out_iounmap_all;
 		}
 		phba->pci_bar4_memmap_p = phba->sli4_hba.dpp_regs_memmap_p;
 	}
@@ -12069,9 +12069,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
 	return 0;
 
 out_iounmap_all:
-	iounmap(phba->sli4_hba.drbl_regs_memmap_p);
+	if (!phba->sli4_hba.drbl_regs_memmap_p)
+		iounmap(phba->sli4_hba.drbl_regs_memmap_p);
 out_iounmap_ctrl:
-	iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
+	if (!phba->sli4_hba.ctrl_regs_memmap_p)
+		iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
 out_iounmap_conf:
 	iounmap(phba->sli4_hba.conf_regs_memmap_p);
 
-- 
2.25.1

Re: [PATCH] scsi: lpfc: fix ioremap issues in 'lpfc_sli4_pci_mem_setup'

[Dan Carpenter]

[-- Attachment #1: Type: text/plain, Size: 762 bytes --]

On Mon, Apr 03, 2023 at 03:48:21PM +0800, lishuchang@hust.edu.cn wrote:
> @@ -12069,9 +12069,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
>  	return 0;
>  
>  out_iounmap_all:
> -	iounmap(phba->sli4_hba.drbl_regs_memmap_p);
> +	if (!phba->sli4_hba.drbl_regs_memmap_p)
> +		iounmap(phba->sli4_hba.drbl_regs_memmap_p);

The test is reversed still.

If you make a mistake, you should write a static checker warning so that
you never make the same mistake again.  ;)  See attached.


>  out_iounmap_ctrl:
> -	iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
> +	if (!phba->sli4_hba.ctrl_regs_memmap_p)

Also reversed.

> +		iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
>  out_iounmap_conf:
>  	iounmap(phba->sli4_hba.conf_regs_memmap_p);

regards,
dan carpenter



[-- Attachment #2: check_passing_possible_null.c --]
[-- Type: text/x-csrc, Size: 1314 bytes --]

/*
 * Copyright (C) 2023 Oracle.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
 */

#include "smatch.h"
#include "smatch_slist.h"

static int my_id;

static void check_non_null(struct expression *expr, const char *name, struct symbol *sym, void *data)
{
	struct sm_state *sm, *tmp;
	sval_t sval;

	sm = get_sm_state(SMATCH_EXTRA, name, sym);
	if (!sm)
		return;

	FOR_EACH_PTR(sm->possible, tmp) {
		if (!estate_get_single_value(tmp->state, &sval) ||
		    sval.value != 0)
			continue;
		sm_warning("'%s' potentially NULL", name);
		return;
	} END_FOR_EACH_PTR(tmp);
}

void check_passing_possible_null(int id)
{
	my_id = id;

	add_function_param_key_hook_early("iounmap", &check_non_null, 0, "$", NULL);
}

Re: [PATCH] scsi: lpfc: fix ioremap issues in 'lpfc_sli4_pci_mem_setup'

[Dongliang Mu]

On 2023/4/3 17:16, Dan Carpenter wrote:
> On Mon, Apr 03, 2023 at 03:48:21PM +0800, lishuchang@hust.edu.cn wrote:
>> @@ -12069,9 +12069,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
>>   	return 0;
>>   
>>   out_iounmap_all:
>> -	iounmap(phba->sli4_hba.drbl_regs_memmap_p);
>> +	if (!phba->sli4_hba.drbl_regs_memmap_p)
>> +		iounmap(phba->sli4_hba.drbl_regs_memmap_p);
> The test is reversed still.

Thanks for your review, Dan. Sorry for my internal careless review. 
Shuchang is creating a v2 patch to fix all the mentioned issues.

Really sorry about this stupid mistake.

>
> If you make a mistake, you should write a static checker warning so that
> you never make the same mistake again.  ;)  See attached.
>
>
>>   out_iounmap_ctrl:
>> -	iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
>> +	if (!phba->sli4_hba.ctrl_regs_memmap_p)
> Also reversed.
>
>> +		iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
>>   out_iounmap_conf:
>>   	iounmap(phba->sli4_hba.conf_regs_memmap_p);
> regards,
> dan carpenter
>
>