scsi: pm8001: Fix tag leaks on error

[ Upstream commit 4c8f04b1905cd4b776d0b720463c091545478ef7 ]

In pm8001_chip_set_dev_state_req(), pm8001_chip_fw_flash_update_req(),
pm80xx_chip_phy_ctl_req() and pm8001_chip_reg_dev_req() add missing calls
to pm8001_tag_free() to free the allocated tag when pm8001_mpi_build_cmd()
fails.

Similarly, in pm8001_exec_internal_task_abort(), if the chip ->task_abort
method fails, the tag allocated for the abort request task must be
freed. Add the missing call to pm8001_tag_free().

Link: https://lore.kernel.org/r/20220220031810.738362-22-damien.lemoal@opensource.wdc.com
Reviewed-by: John Garry <john.garry@huawei.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index 2adf143..619fbcf 100644 (file)
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -4488,6 +4488,9 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha,
                SAS_ADDR_SIZE);
        rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload,
                        sizeof(payload), 0);
+       if (rc)
+               pm8001_tag_free(pm8001_ha, tag);
+
        return rc;
 }
 
@@ -4900,6 +4903,9 @@ pm8001_chip_fw_flash_update_req(struct pm8001_hba_info *pm8001_ha,
        ccb->ccb_tag = tag;
        rc = pm8001_chip_fw_flash_update_build(pm8001_ha, &flash_update_info,
                tag);
+       if (rc)
+               pm8001_tag_free(pm8001_ha, tag);
+
        return rc;
 }
 
@@ -5004,6 +5010,9 @@ pm8001_chip_set_dev_state_req(struct pm8001_hba_info *pm8001_ha,
        payload.nds = cpu_to_le32(state);
        rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload,
                        sizeof(payload), 0);
+       if (rc)
+               pm8001_tag_free(pm8001_ha, tag);
+
        return rc;
 
 }

diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index 491cecb..5fb08ac 100644 (file)
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -831,10 +831,10 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha,
 
                res = PM8001_CHIP_DISP->task_abort(pm8001_ha,
                        pm8001_dev, flag, task_tag, ccb_tag);
-
                if (res) {
                        del_timer(&task->slow_task->timer);
                        pm8001_dbg(pm8001_ha, FAIL, "Executing internal task failed\n");
+                       pm8001_tag_free(pm8001_ha, ccb_tag);
                        goto ex_err;
                }
                wait_for_completion(&task->slow_task->completion);

diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index df140ec..5561057 100644 (file)
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -4920,8 +4920,13 @@ static int pm80xx_chip_phy_ctl_req(struct pm8001_hba_info *pm8001_ha,
        payload.tag = cpu_to_le32(tag);
        payload.phyop_phyid =
                cpu_to_le32(((phy_op & 0xFF) << 8) | (phyId & 0xFF));
-       return pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload,
-                       sizeof(payload), 0);
+
+       rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload,
+                                 sizeof(payload), 0);
+       if (rc)
+               pm8001_tag_free(pm8001_ha, tag);
+
+       return rc;
 }
 
 static u32 pm80xx_chip_is_our_interrupt(struct pm8001_hba_info *pm8001_ha)