[PATCH] scsi: aacraid: fix dma_free_coherent() size

[PATCH] scsi: aacraid: fix dma_free_coherent() size

[Thomas Fourier]

In fib_map_alloc(), dev->hw_fib_va is allocated with
dma_alloc_coherent() with size
    (dev->max_cmd_size + sizeof(struct aac_fib_xporthdr))
    * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB) + (ALIGN32 - 1)
but in aac_fib_map_free(), the same buffer is freed with size
    (dev->max_fib_size + sizeof(struct aac_fib_xporthdr))
    * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB) + (ALIGN32 - 1)

This could leave parts of the freed memory mapped to the device.

Change the dma_free_coherent() size to match the unmap.

This was found with static analysis and only compile tested.

Fixes: 1bff5abca65d ("scsi: aacraid: Fix memory leak in fib init path")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
 drivers/scsi/aacraid/commsup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index c4485629f792..cf0ae251e43b 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -81,7 +81,7 @@ void aac_fib_map_free(struct aac_dev *dev)
 		return;
 
 	num_fibs = dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB;
-	fib_size = dev->max_fib_size + sizeof(struct aac_fib_xporthdr);
+	fib_size = dev->max_cmd_size + sizeof(struct aac_fib_xporthdr);
 	alloc_size = fib_size * num_fibs + ALIGN32 - 1;
 
 	dma_free_coherent(&dev->pdev->dev, alloc_size, dev->hw_fib_va,
-- 
2.53.0