diff options
| author | Chandrakanth Patil <chandrakanth.patil@broadcom.com> | 2026-08-08 20:40:10 +0530 |
|---|---|---|
| committer | Martin K. Petersen (Oracle) <mkp@kernel.org> | 2026-08-13 21:45:38 -0400 |
| commit | b9f679dfe629004b593f018df33b330d799bcee4 (patch) | |
| tree | 556e413d4507fd864e6f4899e70e873717718f26 | |
| parent | 431e735e9bb6b7fd8e2ea9d83f0627bb5c5687ee (diff) | |
| download | linux-b9f679dfe629004b593f018df33b330d799bcee4.tar.gz linux-b9f679dfe629004b593f018df33b330d799bcee4.zip | |
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
_base_release_memory_pools() unconditionally frees every
ioc->pcie_sg_lookup[] entry, including ones the setup loop never
allocated after a partial failure, causing a "bad dma" warning on debug
kernels or a NULL pointer dereference otherwise.
Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission")
Reported-by: Laurence Oberman <loberman@redhat.com>
Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
Link: https://patch.msgid.link/20260808151010.185603-1-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org>
| -rw-r--r-- | drivers/scsi/mpt3sas/mpt3sas_base.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 791a3c5fbf44..fed7aeffec58 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -5870,6 +5870,8 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) if (ioc->pcie_sgl_dma_pool) { for (i = 0; i < ioc->scsiio_depth; i++) { + if (!ioc->pcie_sg_lookup[i].pcie_sgl) + continue; dma_pool_free(ioc->pcie_sgl_dma_pool, ioc->pcie_sg_lookup[i].pcie_sgl, ioc->pcie_sg_lookup[i].pcie_sgl_dma); |