From: Dan Carpenter <dan.carpenter@oracle.com>
To: qutran@marvell.com
Cc: linux-scsi@vger.kernel.org
Subject: [bug report] scsi: qla2xxx: Fix SRB leak on switch command timeout
Date: Wed, 20 Jan 2021 13:57:45 +0300 [thread overview]
Message-ID: <YAgMqa2/7ugeBKVW@mwanda> (raw)
Hello Quinn Tran,
The patch af2a0c51b120: "scsi: qla2xxx: Fix SRB leak on switch
command timeout" from Nov 5, 2019, leads to the following static
checker warning:
drivers/scsi/qla2xxx/qla_os.c:1032 qla2xxx_mqueuecommand()
error: dereferencing freed memory 'sp'
drivers/scsi/qla2xxx/qla_os.c
1020
1021 return 0;
1022
1023 qc24_host_busy_free_sp:
1024 sp->free(sp);
1025
1026 qc24_target_busy:
1027 return SCSI_MLQUEUE_TARGET_BUSY;
1028
1029 qc24_free_sp_fail_command:
1030 sp->free(sp);
1031 CMD_SP(cmd) = NULL;
1032 qla2xxx_rel_qpair_sp(sp->qpair, sp);
This seems like potentially a false positive but the code is weird.
In this case we know that ->free is qla2xxx_qpair_sp_free_dma().
Smatch isn't making that connection and it complains that half the
free functions call qla2xxx_rel_qpair_sp() and half don't. These three
free "sp"
qla2x00_sp_free()
qla2x00_els_dcmd_sp_free()
qla2x00_bsg_sp_free()
The free functions which don't free "sp" are:
qla2x00_sp_free_dma()
qla2xxx_qpair_sp_free_dma()
qla2xxx_rel_free_warning()
1033
1034 qc24_fail_command:
1035 cmd->scsi_done(cmd);
1036
1037 return 0;
1038 }
regards,
dan carpenter
next reply other threads:[~2021-01-20 11:30 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-20 10:57 Dan Carpenter [this message]
2021-01-21 17:03 ` [EXT] [bug report] scsi: qla2xxx: Fix SRB leak on switch command timeout Quinn Tran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YAgMqa2/7ugeBKVW@mwanda \
--to=dan.carpenter@oracle.com \
--cc=linux-scsi@vger.kernel.org \
--cc=qutran@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.