This is a note to let you know that I've just added the patch titled
scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
scsi-lpfc-call-lpfc_sli4_queue_unset-in-restart-and-.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit ac64488ac6a9cc4d2696f36603dfa3419d7a6703
Author: Justin Tee <justin.tee@xxxxxxxxxxxx>
Date: Thu Oct 31 15:32:11 2024 -0700
scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
[ Upstream commit d35f7672715d1ff3e3ad9bb4ae6ac6cb484200fe ]
During initialization, the driver allocates wq->pring in lpfc_wq_create
and lpfc_sli4_queue_unset() is the only place where kfree(wq->pring) is
called.
There is a possible memory leak in lpfc_sli_brdrestart_s4() (restart)
and lpfc_pci_remove_one_s4() (rmmod) paths because there are no calls to
lpfc_sli4_queue_unset() to kfree() the wq->pring.
Fix by inserting a call to lpfc_sli4_queue_unset() in
lpfc_sli_brdrestart_s4() and lpfc_sli4_hba_unset() routines. Also, add
a check for the SLI_ACTIVE flag before issuing the Q_DESTROY mailbox
command. If not set, then the mailbox command will obviously fail. In
such cases, skip issuing the mailbox command and only execute the driver
resource clean up portions of the lpfc_*q_destroy routines.
Signed-off-by: Justin Tee <justin.tee@xxxxxxxxxxxx>
Link: https://lore.kernel.org/r/20241031223219.152342-4-justintee8345@xxxxxxxxx
Signed-off-by: Martin K. Petersen <martin.petersen@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 416816d74ea1c..424b39a8155cb 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -13513,6 +13513,8 @@ lpfc_sli4_hba_unset(struct lpfc_hba *phba)
/* Disable FW logging to host memory */
lpfc_ras_stop_fwlog(phba);
+ lpfc_sli4_queue_unset(phba);
+
/* Reset SLI4 HBA FCoE function */
lpfc_pci_function_reset(phba);
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 9b1ffa84a0629..4a9fa00eeb798 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -5285,6 +5285,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba)
"0296 Restart HBA Data: x%x x%x\n",
phba->pport->port_state, psli->sli_flag);
+ lpfc_sli4_queue_unset(phba);
+
rc = lpfc_sli4_brdreset(phba);
if (rc) {
phba->link_state = LPFC_HBA_ERROR;
@@ -17630,6 +17632,9 @@ lpfc_eq_destroy(struct lpfc_hba *phba, struct lpfc_queue *eq)
if (!eq)
return -ENODEV;
+ if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+ goto list_remove;
+
mbox = mempool_alloc(eq->phba->mbox_mem_pool, GFP_KERNEL);
if (!mbox)
return -ENOMEM;
@@ -17656,10 +17661,12 @@ lpfc_eq_destroy(struct lpfc_hba *phba, struct lpfc_queue *eq)
shdr_status, shdr_add_status, rc);
status = -ENXIO;
}
+ mempool_free(mbox, eq->phba->mbox_mem_pool);
+list_remove:
/* Remove eq from any list */
list_del_init(&eq->list);
- mempool_free(mbox, eq->phba->mbox_mem_pool);
+
return status;
}
@@ -17687,6 +17694,10 @@ lpfc_cq_destroy(struct lpfc_hba *phba, struct lpfc_queue *cq)
/* sanity check on queue memory */
if (!cq)
return -ENODEV;
+
+ if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+ goto list_remove;
+
mbox = mempool_alloc(cq->phba->mbox_mem_pool, GFP_KERNEL);
if (!mbox)
return -ENOMEM;
@@ -17712,9 +17723,11 @@ lpfc_cq_destroy(struct lpfc_hba *phba, struct lpfc_queue *cq)
shdr_status, shdr_add_status, rc);
status = -ENXIO;
}
+ mempool_free(mbox, cq->phba->mbox_mem_pool);
+
+list_remove:
/* Remove cq from any list */
list_del_init(&cq->list);
- mempool_free(mbox, cq->phba->mbox_mem_pool);
return status;
}
@@ -17742,6 +17755,10 @@ lpfc_mq_destroy(struct lpfc_hba *phba, struct lpfc_queue *mq)
/* sanity check on queue memory */
if (!mq)
return -ENODEV;
+
+ if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+ goto list_remove;
+
mbox = mempool_alloc(mq->phba->mbox_mem_pool, GFP_KERNEL);
if (!mbox)
return -ENOMEM;
@@ -17767,9 +17784,11 @@ lpfc_mq_destroy(struct lpfc_hba *phba, struct lpfc_queue *mq)
shdr_status, shdr_add_status, rc);
status = -ENXIO;
}
+ mempool_free(mbox, mq->phba->mbox_mem_pool);
+
+list_remove:
/* Remove mq from any list */
list_del_init(&mq->list);
- mempool_free(mbox, mq->phba->mbox_mem_pool);
return status;
}
@@ -17797,6 +17816,10 @@ lpfc_wq_destroy(struct lpfc_hba *phba, struct lpfc_queue *wq)
/* sanity check on queue memory */
if (!wq)
return -ENODEV;
+
+ if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+ goto list_remove;
+
mbox = mempool_alloc(wq->phba->mbox_mem_pool, GFP_KERNEL);
if (!mbox)
return -ENOMEM;
@@ -17821,11 +17844,13 @@ lpfc_wq_destroy(struct lpfc_hba *phba, struct lpfc_queue *wq)
shdr_status, shdr_add_status, rc);
status = -ENXIO;
}
+ mempool_free(mbox, wq->phba->mbox_mem_pool);
+
+list_remove:
/* Remove wq from any list */
list_del_init(&wq->list);
kfree(wq->pring);
wq->pring = NULL;
- mempool_free(mbox, wq->phba->mbox_mem_pool);
return status;
}
@@ -17855,6 +17880,10 @@ lpfc_rq_destroy(struct lpfc_hba *phba, struct lpfc_queue *hrq,
/* sanity check on queue memory */
if (!hrq || !drq)
return -ENODEV;
+
+ if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE))
+ goto list_remove;
+
mbox = mempool_alloc(hrq->phba->mbox_mem_pool, GFP_KERNEL);
if (!mbox)
return -ENOMEM;
@@ -17895,9 +17924,11 @@ lpfc_rq_destroy(struct lpfc_hba *phba, struct lpfc_queue *hrq,
shdr_status, shdr_add_status, rc);
status = -ENXIO;
}
+ mempool_free(mbox, hrq->phba->mbox_mem_pool);
+
+list_remove:
list_del_init(&hrq->list);
list_del_init(&drq->list);
- mempool_free(mbox, hrq->phba->mbox_mem_pool);
return status;
}
