Commit b0a166e9 authored by Chandrakanth Patil's avatar Chandrakanth Patil Committed by Luo Gengkun
Browse files

scsi: megaraid_sas: Fix resource leak in case of probe failure 

mainline inclusion
from mainline-v5.14-rc1
commit b5438f48
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RQ71
CVE: CVE-2021-47329

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5438f48fdd8e1c3f130d32637511efd32038152

--------------------------------

The driver doesn't clean up all the allocated resources properly when
scsi_add_host(), megasas_start_aen() function fails during the PCI device
probe.

Clean up all those resources.

Link: https://lore.kernel.org/r/20210528131307.25683-3-chandrakanth.patil@broadcom.com


Signed-off-by: default avatarChandrakanth Patil <chandrakanth.patil@broadcom.com>
Signed-off-by: default avatarSumit Saxena <sumit.saxena@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>

Conflicts:
	drivers/scsi/megaraid/megaraid_sas_base.c
Signed-off-by: default avatarLuo Gengkun <luogengkun2@huawei.com>
parent d2901c3f

drivers/scsi/megaraid/megaraid_sas_base.c

+10 −0
Original line number Diff line number Diff line
@@ -6620,11 +6620,16 @@ static int megasas_probe_one(struct pci_dev *pdev, 
	return 0;



fail_start_aen:

	instance->unload = 1;

	scsi_remove_host(instance->host);

fail_io_attach:

	megasas_mgmt_info.count--;

	megasas_mgmt_info.max_index--;

	megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL;



	if (instance->requestorId && !instance->skip_heartbeat_timer_del)

		del_timer_sync(&instance->sriov_heartbeat_timer);



	instance->instancet->disable_intr(instance);

	megasas_destroy_irqs(instance);
@@ -6632,8 +6637,13 @@ static int megasas_probe_one(struct pci_dev *pdev, 
		megasas_release_fusion(instance);

	else

		megasas_release_mfi(instance);



	if (instance->msix_vectors)

		pci_free_irq_vectors(instance->pdev);

	instance->msix_vectors = 0;



	if (instance->fw_crash_state != UNAVAILABLE)

		megasas_free_host_crash_buffer(instance);

fail_init_mfi:

	scsi_host_put(host);

fail_alloc_instance:

drivers/scsi/megaraid/megaraid_sas_fusion.c

+1 −0
Original line number Diff line number Diff line
@@ -4857,6 +4857,7 @@ megasas_alloc_fusion_context(struct megasas_instance *instance) 
		if (!fusion->log_to_span) {

			dev_err(&instance->pdev->dev, "Failed from %s %d\n",

				__func__, __LINE__);

			kfree(instance->ctrl_context);

			return -ENOMEM;

		}

	}