[PATCH] scsi: mpt3sas: fix invalid kfree of embedded event_data in event callback

[PATCH] scsi: mpt3sas: fix invalid kfree of embedded event_data in event callback

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

fw_event->event_data is a flexible array member embedded within the
fw_event_work structure (allocated as a single kzalloc). Calling
kfree(fw_event->event_data) on it is invalid and can corrupt the heap,
since it is not a separately allocated pointer.

The subsequent fw_event_work_put() will decrement the refcount to zero
and call fw_event_work_free(), which frees the entire fw_event_work
structure (including the embedded event_data). The extra kfree() is
therefore both wrong and redundant.

Remove the erroneous kfree(fw_event->event_data) call in the
MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST error path. The PCIE topology
change list handler already handles this correctly without the extra
kfree.

Fixes: ad59571931072e6f ("scsi: mpt3sas: Add firmware event requeue support for busy devices")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 12caffe..ca01a49 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -12267,7 +12267,6 @@ mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index,
 		if (!fw_event->retries) {
 
 			ioc_err(ioc, "failure at %s:%d/%s()!\n",  __FILE__, __LINE__, __func__);
-			kfree(fw_event->event_data);
 			fw_event_work_put(fw_event);
 			return 1;
 		}
-- 
2.9.4

答复: [PATCH] scsi: mpt3sas: fix invalid kfree of embedded event_data in event callback

[Li,Rongqing]

> 
> From: Li RongQing <lirongqing@baidu.com>
> 
> fw_event->event_data is a flexible array member embedded within the
> fw_event_work structure (allocated as a single kzalloc). Calling
> kfree(fw_event->event_data) on it is invalid and can corrupt the heap, since it
> is not a separately allocated pointer.
> 
> The subsequent fw_event_work_put() will decrement the refcount to zero
> and call fw_event_work_free(), which frees the entire fw_event_work
> structure (including the embedded event_data). The extra kfree() is therefore
> both wrong and redundant.
> 
> Remove the erroneous kfree(fw_event->event_data) call in the
> MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST error path. The PCIE topology
> change list handler already handles this correctly without the extra kfree.
> 
> Fixes: ad59571931072e6f ("scsi: mpt3sas: Add firmware event requeue
> support for busy devices")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Ping

[Li,Rongqing] 


> ---
>  drivers/scsi/mpt3sas/mpt3sas_scsih.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
> b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
> index 12caffe..ca01a49 100644
> --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
> +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
> @@ -12267,7 +12267,6 @@ mpt3sas_scsih_event_callback(struct
> MPT3SAS_ADAPTER *ioc, u8 msix_index,
>  		if (!fw_event->retries) {
> 
>  			ioc_err(ioc, "failure at %s:%d/%s()!\n",  __FILE__, __LINE__,
> __func__);
> -			kfree(fw_event->event_data);
>  			fw_event_work_put(fw_event);
>  			return 1;
>  		}
> --
> 2.9.4