Commit fa96392e authored by Ranjan Kumar's avatar Ranjan Kumar Committed by Martin K. Petersen
Browse files

scsi: mpi3mr: Add NULL checks when resetting request and reply queues 



The driver encountered a crash during resource cleanup when the reply and
request queues were NULL due to freed memory.  This issue occurred when the
creation of reply or request queues failed, and the driver freed the memory
first, but attempted to mem set the content of the freed memory, leading to
a system crash.

Add NULL pointer checks for reply and request queues before accessing the
reply/request memory during cleanup

Signed-off-by: default avatarRanjan Kumar <ranjan.kumar@broadcom.com>
Link: https://patch.msgid.link/20260212070026.30263-1-ranjan.kumar@broadcom.com


Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 5b313760

drivers/scsi/mpi3mr/mpi3mr_fw.c

+19 −15
Original line number Diff line number Diff line
@@ -4806,6 +4806,7 @@ void mpi3mr_memset_buffers(struct mpi3mr_ioc *mrioc) 
	}



	for (i = 0; i < mrioc->num_queues; i++) {

		if (mrioc->op_reply_qinfo) {

			mrioc->op_reply_qinfo[i].qid = 0;

			mrioc->op_reply_qinfo[i].ci = 0;

			mrioc->op_reply_qinfo[i].num_replies = 0;
@@ -4813,7 +4814,9 @@ void mpi3mr_memset_buffers(struct mpi3mr_ioc *mrioc) 
			atomic_set(&mrioc->op_reply_qinfo[i].pend_ios, 0);

			atomic_set(&mrioc->op_reply_qinfo[i].in_use, 0);

			mpi3mr_memset_op_reply_q_buffers(mrioc, i);

		}



		if (mrioc->req_qinfo) {

			mrioc->req_qinfo[i].ci = 0;

			mrioc->req_qinfo[i].pi = 0;

			mrioc->req_qinfo[i].num_requests = 0;
@@ -4822,6 +4825,7 @@ void mpi3mr_memset_buffers(struct mpi3mr_ioc *mrioc) 
			spin_lock_init(&mrioc->req_qinfo[i].q_lock);

			mpi3mr_memset_op_req_q_buffers(mrioc, i);

		}

	}



	atomic_set(&mrioc->pend_large_data_sz, 0);

	if (mrioc->throttle_groups) {