Re: [PATCH] scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
Laurence Oberman <[email protected]>
| Newsgroups | org.kernel.vger.linux-scsi |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 2026-08-08 at 20:40 +0530, Chandrakanth Patil wrote:
> _base_release_memory_pools() unconditionally frees every
> ioc->pcie_sg_lookup[] entry, including ones the setup loop never
> allocated after a partial failure, causing a "bad dma" warning on
> debug kernels or a NULL pointer dereference otherwise.
>
> Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission")
> Reported-by: Laurence Oberman <[email protected]>
> Signed-off-by: Chandrakanth Patil <[email protected]>
> ---
> drivers/scsi/mpt3sas/mpt3sas_base.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c
> b/drivers/scsi/mpt3sas/mpt3sas_base.c
> index 79052f2accbd..11bcb8440e1c 100644
> --- a/drivers/scsi/mpt3sas/mpt3sas_base.c
> +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
> @@ -5870,6 +5870,8 @@ _base_release_memory_pools(struct
> MPT3SAS_ADAPTER *ioc)
>
> if (ioc->pcie_sgl_dma_pool) {
> for (i = 0; i < ioc->scsiio_depth; i++) {
> + if (!ioc->pcie_sg_lookup[i].pcie_sgl)
> + continue;
> dma_pool_free(ioc->pcie_sgl_dma_pool,
> ioc-
> >pcie_sg_lookup[i].pcie_sgl,
> ioc-
> >pcie_sg_lookup[i].pcie_sgl_dma);
Was also tested by a customer, Given the Sahishko analysis was
responded to and a follow up patch for that will be coming:
Reviewed-by: Laurence Oberman ,[email protected]>