Commit 2bfd6256 authored by Michal Grzedzicki's avatar Michal Grzedzicki Committed by Li Lingfeng
Browse files

scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command 

mainline inclusion
from mainline-v6.6-rc2
commit c13e7331
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2S
CVE: CVE-2023-52500

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c13e7331745852d0dd7c35eabbe181cbd5b01172



--------------------------------

Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed
when we receive the response.

Signed-off-by: default avatarMichal Grzedzicki <mge@meta.com>
Link: https://lore.kernel.org/r/20230911170340.699533-2-mge@meta.com


Acked-by: default avatarJack Wang <jinpu.wang@ionos.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent 84f30849

drivers/scsi/pm8001/pm80xx_hwi.c

+2 −0
Original line number Diff line number Diff line
@@ -3731,10 +3731,12 @@ static int mpi_set_controller_config_resp(struct pm8001_hba_info *pm8001_ha, 
			(struct set_ctrl_cfg_resp *)(piomb + 4);

	u32 status = le32_to_cpu(pPayload->status);

	u32 err_qlfr_pgcd = le32_to_cpu(pPayload->err_qlfr_pgcd);

	u32 tag = le32_to_cpu(pPayload->tag);



	pm8001_dbg(pm8001_ha, MSG,

		   "SET CONTROLLER RESP: status 0x%x qlfr_pgcd 0x%x\n",

		   status, err_qlfr_pgcd);

	pm8001_tag_free(pm8001_ha, tag);



	return 0;

}