From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03EC138E5C5 for ; Mon, 8 Jun 2026 06:36:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780900619; cv=none; b=p6C5UBHP6upjECK/0k0wnwC+W0kyZ0Y0oNU0TvN2kKtw0gdf6FGPl0dj098fn4ieYt7o7m/PVvJR3yfGMx3xXLZEDyq3pN5UZppgF3lQvGdnBQ/hVFViRUAPejtbS4ke6p6jilCoQHSHc4qdEI2VrFr8EMeEiHEeiHDgODJrA08= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780900619; c=relaxed/simple; bh=KMrV5pPr+i5O8xxCSE4GsNvdoC2291zJwjpszQOG2BY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nFz9JlG5oFFe368VfxdhbwV8OCtko3HtZiZmQDvHnsZeBJnByiuohyA8PjW7vm3ks/XzvmZAGZRyN7IAdp93j9C06Kq5LYmxu/t9JAtT49epl1uK1+3VPTtmtllbyH7bI0D0VY8kZkv3B+EWh8huD6AHVsjTRt55vkEzFX+COm0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kYzDf7H6; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kYzDf7H6" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2bf30d530bdso40428815ad.3 for ; Sun, 07 Jun 2026 23:36:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780900615; x=1781505415; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=QyOrzsXzZonT6xdVUXrU9TKr4z89jWxC1bOyHjr9z4Y=; b=kYzDf7H6l5nZEZcevEg45ZDi7bVbftHCvSGpI4lzl4GV2fMqPg5wYXMD9td8VHRYTh VtFs0ZsrFD60PO/GaHLdIavF5DdluqsR8LHQwSODf50Lp3gVQhdkchBEOEfsxZiYGWJ0 atfoNeOb27RQP8v4Dq9jO0TFcok432cvyGYdr5N3UigPXn/cXCQe/jjMl5Rru3EW/ANQ GXdEw43LjOqwCR7BngeCcTyaXH/kyL47BtXZbrnalJs/J6wpY4xHc9MPfFjxiGbn0aiD 8NTRtx185dX00dsMwlq/3Opf/9xRX4Ik28duMt6BFP4dzgHh9/WajPMqzbbBDIiEgZwz rANA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780900615; x=1781505415; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=QyOrzsXzZonT6xdVUXrU9TKr4z89jWxC1bOyHjr9z4Y=; b=On9Mr/WSSmWt8zSaOMq0S19tiXgzh7wvI/e2GvyrUGzKYcIHvkYsRAqTG4Egu0aMl4 GK6s/ckev6VkvvTPJAcwwGP+WuzHMPRxrMO/vC68LFOJFGO5jBlfrH3a3K0sIow6+fBb l+rySxGsObnXGEN/veYlsyczHTG4f9iPkpLUwHi+QdNcazTUzSBxoc2Edsp7PAogeAQs xrlSIWNDIV+rWL23QdjTBCcDGUuoFyJ8EpJHhNeemZe8soFxc3pqk7VYUDJLc+bafnCi zMqf9wRf0D3po6VmHdE4GqvLWyx2/KMv2CK0wGKQeyYqjZQFtStzDAAS21eLaX92tG/k tV0w== X-Forwarded-Encrypted: i=1; AFNElJ+8RaKf7JU32P3fe0sV84WyOEZ9FNrYEA3OKNbQhbAuOUJnXR/aCBAGigELTYFbVev8w7AVO2zZcNhd3lA=@vger.kernel.org X-Gm-Message-State: AOJu0YzmQkTRwLibr/iigFTOrczenNKaL/tc2VN3YyB5f8etrYFLwiPM FbZ5lsypoXSjhDu673LwywRRiOK1xVx7WVxK7A/gfOZiUyr6n1MASfLKIZZLEBkAt1s= X-Gm-Gg: Acq92OFCyPJd5FHa5sJSSL3aFOPUOpS7Tb5ULUuk2IgqUkMdaEmCikwZdFD2yH4PgyX qwtTmMTc9uq/TohQPE0/APes2kcD7OtjB547OSzk5yz3K4GMc49wxL7aY/e9lT7P9D8szNzIQ5F KXhSBBs4hu6SH7VRwSNgfhF6m/4U1UPbmS4oxwNqMh/xpNy6+N60iadX2Q41CkEPg1IlE4ycgwj J1+PO8aIThGxRSvQFp7kDXcDQSyLezwiM8VSoipgEZ/T+5swvPGiDazYvm+LcPNM+pbGi+8BRJR sRiMalAf5OI9TaaAp1Vlbv01ej3Aj3Z5mHHprPKQaOASSUz9/ERC9OKJhBFX9YYv1V5JqQgBTRA 4qHYjWhQebdoCsc/KQmNQ8uN9WIRH1hpOvLUn8+Sp+xwcc/8IawaFEp0Tbc0U485jDR8ITSFNZo XKrp81Rtfu1ZbznRBILCAsvNqKWSGgxZgzXDYS5v6m7/5ZW2wGK4wJ X-Received: by 2002:a17:902:da86:b0:2c0:f807:56b6 with SMTP id d9443c01a7336-2c1e7b3578cmr149366865ad.4.1780900615167; Sun, 07 Jun 2026 23:36:55 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:9a2:954d:67fe:d9c2]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c16629cf89sm171820725ad.56.2026.06.07.23.36.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 07 Jun 2026 23:36:54 -0700 (PDT) From: Ruoyu Wang To: "James E . J . Bottomley" , "Martin K . Petersen" Cc: linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] scsi: arcmsr: check XOR DMA allocations Date: Mon, 8 Jun 2026 14:36:50 +0800 Message-ID: <20260608063650.54-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit arcmsr_alloc_xor_buffer() allocates the XOR metadata area with dma_alloc_coherent() and then derives the XOR scatter-gather metadata from the returned pointer. If the coherent allocation fails, the metadata setup would dereference NULL. Check the metadata allocation before using it. If a later XOR segment allocation fails, release the partially allocated XOR buffers immediately and clear the XOR state so the common CCB pool cleanup can safely release only the CCB pool. If XOR buffer setup fails after the CCB pool has been allocated, release the CCB pool before returning the allocation error so the caller does not leak the partially initialized resources. Signed-off-by: Ruoyu Wang --- drivers/scsi/arcmsr/arcmsr_hba.c | 70 +++++++++++++++++++------------- 1 file changed, 42 insertions(+), 28 deletions(-) diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c index 8aa948f06cacf..c2ef752fd34c0 100644 --- a/drivers/scsi/arcmsr/arcmsr_hba.c +++ b/drivers/scsi/arcmsr/arcmsr_hba.c @@ -753,9 +753,39 @@ static bool arcmsr_alloc_io_queue(struct AdapterControlBlock *acb) return rtn; } +static void arcmsr_free_xor_buffer(struct AdapterControlBlock *acb, int entries) +{ + struct Xor_sg *xor_phys; + void **xor_virt; + int i; + + if (!acb->xorVirt) + return; + xor_phys = (struct Xor_sg *)(acb->xorVirt + + sizeof(struct HostRamBuf)); + xor_virt = (void **)((unsigned long)acb->xorVirt + + (unsigned long)acb->xorVirtOffset); + for (i = 0; i < entries; i++) { + if (xor_phys->xorPhys) { + dma_free_coherent(&acb->pdev->dev, + ARCMSR_XOR_SEG_SIZE, + *xor_virt, xor_phys->xorPhys); + xor_phys->xorPhys = 0; + *xor_virt = NULL; + } + xor_phys++; + xor_virt++; + } + dma_free_coherent(&acb->pdev->dev, acb->init2cfg_size, + acb->xorVirt, acb->xorPhys); + acb->xorVirt = NULL; + acb->xorPhys = 0; + acb->xorVirtOffset = 0; + acb->xor_mega = 0; +} + static int arcmsr_alloc_xor_buffer(struct AdapterControlBlock *acb) { - int rc = 0; struct pci_dev *pdev = acb->pdev; void *dma_coherent; dma_addr_t dma_coherent_handle; @@ -771,6 +801,10 @@ static int arcmsr_alloc_xor_buffer(struct AdapterControlBlock *acb) (sizeof(struct XorHandle) * acb->xor_mega); dma_coherent = dma_alloc_coherent(&pdev->dev, acb->init2cfg_size, &dma_coherent_handle, GFP_KERNEL); + if (!dma_coherent) { + acb->xor_mega = 0; + return -ENOMEM; + } acb->xorVirt = dma_coherent; acb->xorPhys = dma_coherent_handle; pXorPhys = (struct Xor_sg *)((unsigned long)dma_coherent + @@ -792,8 +826,8 @@ static int arcmsr_alloc_xor_buffer(struct AdapterControlBlock *acb) } else { pr_info("arcmsr%d: alloc max XOR buffer = 0x%x MB\n", acb->host->host_no, i); - rc = -ENOMEM; - break; + arcmsr_free_xor_buffer(acb, i); + return -ENOMEM; } } pRamBuf = (struct HostRamBuf *)acb->xorVirt; @@ -801,7 +835,7 @@ static int arcmsr_alloc_xor_buffer(struct AdapterControlBlock *acb) pRamBuf->hrbSize = i * ARCMSR_XOR_SEG_SIZE; pRamBuf->hrbRes[0] = 0; pRamBuf->hrbRes[1] = 0; - return rc; + return 0; } static int arcmsr_alloc_ccb_pool(struct AdapterControlBlock *acb) @@ -895,8 +929,10 @@ static int arcmsr_alloc_ccb_pool(struct AdapterControlBlock *acb) break; } if ((acb->firm_PicStatus >> 24) & 0x0f) { - if (arcmsr_alloc_xor_buffer(acb)) + if (arcmsr_alloc_xor_buffer(acb)) { + arcmsr_free_ccb_pool(acb); return -ENOMEM; + } } return 0; } @@ -2083,29 +2119,7 @@ static void arcmsr_stop_adapter_bgrb(struct AdapterControlBlock *acb) static void arcmsr_free_ccb_pool(struct AdapterControlBlock *acb) { - if (acb->xor_mega) { - struct Xor_sg *pXorPhys; - void **pXorVirt; - int i; - - pXorPhys = (struct Xor_sg *)(acb->xorVirt + - sizeof(struct HostRamBuf)); - pXorVirt = (void **)((unsigned long)acb->xorVirt + - (unsigned long)acb->xorVirtOffset); - for (i = 0; i < acb->xor_mega; i++) { - if (pXorPhys->xorPhys) { - dma_free_coherent(&acb->pdev->dev, - ARCMSR_XOR_SEG_SIZE, - *pXorVirt, pXorPhys->xorPhys); - pXorPhys->xorPhys = 0; - *pXorVirt = NULL; - } - pXorPhys++; - pXorVirt++; - } - dma_free_coherent(&acb->pdev->dev, acb->init2cfg_size, - acb->xorVirt, acb->xorPhys); - } + arcmsr_free_xor_buffer(acb, acb->xor_mega); dma_free_coherent(&acb->pdev->dev, acb->uncache_size, acb->dma_coherent, acb->dma_coherent_handle); } -- 2.51.0