[PATCH] scsi: mpt3sas: fix invalid kfree of embedded event_data in event callback

[lirongqing <lirongqing@baidu.com>]

From: Li RongQing <lirongqing@baidu.com>

fw_event->event_data is a flexible array member embedded within the
fw_event_work structure (allocated as a single kzalloc). Calling
kfree(fw_event->event_data) on it is invalid and can corrupt the heap,
since it is not a separately allocated pointer.

The subsequent fw_event_work_put() will decrement the refcount to zero
and call fw_event_work_free(), which frees the entire fw_event_work
structure (including the embedded event_data). The extra kfree() is
therefore both wrong and redundant.

Remove the erroneous kfree(fw_event->event_data) call in the
MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST error path. The PCIE topology
change list handler already handles this correctly without the extra
kfree.

Fixes: ad59571931072e6f ("scsi: mpt3sas: Add firmware event requeue support for busy devices")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 12caffe..ca01a49 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -12267,7 +12267,6 @@ mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index,
 		if (!fw_event->retries) {
 
 			ioc_err(ioc, "failure at %s:%d/%s()!\n",  __FILE__, __LINE__, __func__);
-			kfree(fw_event->event_data);
 			fw_event_work_put(fw_event);
 			return 1;
 		}
-- 
2.9.4