* [bug report] scsi: qla2xxx: Fix SRB leak on switch command timeout
@ 2021-01-20 10:57 Dan Carpenter
2021-01-21 17:03 ` [EXT] " Quinn Tran
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2021-01-20 10:57 UTC (permalink / raw)
To: qutran; +Cc: linux-scsi
Hello Quinn Tran,
The patch af2a0c51b120: "scsi: qla2xxx: Fix SRB leak on switch
command timeout" from Nov 5, 2019, leads to the following static
checker warning:
drivers/scsi/qla2xxx/qla_os.c:1032 qla2xxx_mqueuecommand()
error: dereferencing freed memory 'sp'
drivers/scsi/qla2xxx/qla_os.c
1020
1021 return 0;
1022
1023 qc24_host_busy_free_sp:
1024 sp->free(sp);
1025
1026 qc24_target_busy:
1027 return SCSI_MLQUEUE_TARGET_BUSY;
1028
1029 qc24_free_sp_fail_command:
1030 sp->free(sp);
1031 CMD_SP(cmd) = NULL;
1032 qla2xxx_rel_qpair_sp(sp->qpair, sp);
This seems like potentially a false positive but the code is weird.
In this case we know that ->free is qla2xxx_qpair_sp_free_dma().
Smatch isn't making that connection and it complains that half the
free functions call qla2xxx_rel_qpair_sp() and half don't. These three
free "sp"
qla2x00_sp_free()
qla2x00_els_dcmd_sp_free()
qla2x00_bsg_sp_free()
The free functions which don't free "sp" are:
qla2x00_sp_free_dma()
qla2xxx_qpair_sp_free_dma()
qla2xxx_rel_free_warning()
1033
1034 qc24_fail_command:
1035 cmd->scsi_done(cmd);
1036
1037 return 0;
1038 }
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
* RE: [EXT] [bug report] scsi: qla2xxx: Fix SRB leak on switch command timeout
2021-01-20 10:57 [bug report] scsi: qla2xxx: Fix SRB leak on switch command timeout Dan Carpenter
@ 2021-01-21 17:03 ` Quinn Tran
0 siblings, 0 replies; 2+ messages in thread
From: Quinn Tran @ 2021-01-21 17:03 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-scsi
Dan,
Thanks for notification. Will take a look.
Regards,
Quinn Tran
-----Original Message-----
From: Dan Carpenter <dan.carpenter@oracle.com>
Sent: Wednesday, January 20, 2021 2:58 AM
To: Quinn Tran <qutran@marvell.com>
Cc: linux-scsi@vger.kernel.org
Subject: [EXT] [bug report] scsi: qla2xxx: Fix SRB leak on switch command timeout
External Email
----------------------------------------------------------------------
Hello Quinn Tran,
The patch af2a0c51b120: "scsi: qla2xxx: Fix SRB leak on switch command timeout" from Nov 5, 2019, leads to the following static checker warning:
drivers/scsi/qla2xxx/qla_os.c:1032 qla2xxx_mqueuecommand()
error: dereferencing freed memory 'sp'
drivers/scsi/qla2xxx/qla_os.c
1020
1021 return 0;
1022
1023 qc24_host_busy_free_sp:
1024 sp->free(sp);
1025
1026 qc24_target_busy:
1027 return SCSI_MLQUEUE_TARGET_BUSY;
1028
1029 qc24_free_sp_fail_command:
1030 sp->free(sp);
1031 CMD_SP(cmd) = NULL;
1032 qla2xxx_rel_qpair_sp(sp->qpair, sp);
This seems like potentially a false positive but the code is weird.
In this case we know that ->free is qla2xxx_qpair_sp_free_dma().
Smatch isn't making that connection and it complains that half the free functions call qla2xxx_rel_qpair_sp() and half don't. These three free "sp"
qla2x00_sp_free()
qla2x00_els_dcmd_sp_free()
qla2x00_bsg_sp_free()
The free functions which don't free "sp" are:
qla2x00_sp_free_dma()
qla2xxx_qpair_sp_free_dma()
qla2xxx_rel_free_warning()
1033
1034 qc24_fail_command:
1035 cmd->scsi_done(cmd);
1036
1037 return 0;
1038 }
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-01-21 17:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-20 10:57 [bug report] scsi: qla2xxx: Fix SRB leak on switch command timeout Dan Carpenter
2021-01-21 17:03 ` [EXT] " Quinn Tran
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.