From owner-svn-src-head@freebsd.org Fri Dec 21 20:29:18 2018 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 724D91355D8A; Fri, 21 Dec 2018 20:29:18 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 1184282A09; Fri, 21 Dec 2018 20:29:18 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 032A21A84C; Fri, 21 Dec 2018 20:29:18 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id wBLKTHKO008397; Fri, 21 Dec 2018 20:29:17 GMT (envelope-from cem@FreeBSD.org) Received: (from cem@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id wBLKTHx4008393; Fri, 21 Dec 2018 20:29:17 GMT (envelope-from cem@FreeBSD.org) Message-Id: <201812212029.wBLKTHx4008393@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cem set sender to cem@FreeBSD.org using -f From: Conrad Meyer Date: Fri, 21 Dec 2018 20:29:17 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r342354 - in head/sys/dev: mpr mps X-SVN-Group: head X-SVN-Commit-Author: cem X-SVN-Commit-Paths: in head/sys/dev: mpr mps X-SVN-Commit-Revision: 342354 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Queue-Id: 1184282A09 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_LONG(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.96)[-0.964,0] X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Dec 2018 20:29:18 -0000 Author: cem Date: Fri Dec 21 20:29:16 2018 New Revision: 342354 URL: https://svnweb.freebsd.org/changeset/base/342354 Log: mps(4), mpr(4): Fix lifetime of command buffer for mp?sas_get_sata_identify In the event that the ID command timed out, mps(4)/mpr(4) did not free the command until it could be cancelled. However, it freed the associated buffer (cm_data). Fix the lifetime issue by freeing the associated buffer only after Abort Task or controller reset. Reviewed by: scottl Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D18612 Modified: head/sys/dev/mpr/mpr_sas.c head/sys/dev/mpr/mpr_sas_lsi.c head/sys/dev/mps/mps_sas.c head/sys/dev/mps/mps_sas_lsi.c Modified: head/sys/dev/mpr/mpr_sas.c ============================================================================== --- head/sys/dev/mpr/mpr_sas.c Fri Dec 21 20:12:43 2018 (r342353) +++ head/sys/dev/mpr/mpr_sas.c Fri Dec 21 20:29:16 2018 (r342354) @@ -1169,6 +1169,12 @@ mprsas_complete_all_commands(struct mpr_softc *sc) cm->cm_reply = NULL; completed = 0; + if (cm->cm_flags & MPR_CM_FLAGS_SATA_ID_TIMEOUT) { + MPASS(cm->cm_data); + free(cm->cm_data, M_MPR); + cm->cm_data = NULL; + } + if (cm->cm_flags & MPR_CM_FLAGS_POLLED) cm->cm_flags |= MPR_CM_FLAGS_COMPLETE; Modified: head/sys/dev/mpr/mpr_sas_lsi.c ============================================================================== --- head/sys/dev/mpr/mpr_sas_lsi.c Fri Dec 21 20:12:43 2018 (r342353) +++ head/sys/dev/mpr/mpr_sas_lsi.c Fri Dec 21 20:29:16 2018 (r342354) @@ -1026,6 +1026,7 @@ out: for (i = 1; i < sc->num_reqs; i++) { cm = &sc->commands[i]; if (cm->cm_flags & MPR_CM_FLAGS_SATA_ID_TIMEOUT) { + free(cm->cm_data, M_MPR); mpr_free_command(sc, cm); } } @@ -1208,15 +1209,14 @@ mprsas_get_sata_identify(struct mpr_softc *sc, u16 han out: /* * If the SATA_ID_TIMEOUT flag has been set for this command, don't free - * it. The command will be freed after sending a target reset TM. If - * the command did timeout, use EWOULDBLOCK. + * it. The command and buffer will be freed after sending an Abort + * Task TM. If the command did timeout, use EWOULDBLOCK. */ - if ((cm->cm_flags & MPR_CM_FLAGS_SATA_ID_TIMEOUT) == 0) + if ((cm->cm_flags & MPR_CM_FLAGS_SATA_ID_TIMEOUT) == 0) { mpr_free_command(sc, cm); - else if (error == 0) + free(buffer, M_MPR); + } else if (error == 0) error = EWOULDBLOCK; - cm->cm_data = NULL; - free(buffer, M_MPR); return (error); } Modified: head/sys/dev/mps/mps_sas.c ============================================================================== --- head/sys/dev/mps/mps_sas.c Fri Dec 21 20:12:43 2018 (r342353) +++ head/sys/dev/mps/mps_sas.c Fri Dec 21 20:29:16 2018 (r342354) @@ -1108,6 +1108,12 @@ mpssas_complete_all_commands(struct mps_softc *sc) cm->cm_reply = NULL; completed = 0; + if (cm->cm_flags & MPS_CM_FLAGS_SATA_ID_TIMEOUT) { + MPASS(cm->cm_data); + free(cm->cm_data, M_MPT2); + cm->cm_data = NULL; + } + if (cm->cm_flags & MPS_CM_FLAGS_POLLED) cm->cm_flags |= MPS_CM_FLAGS_COMPLETE; Modified: head/sys/dev/mps/mps_sas_lsi.c ============================================================================== --- head/sys/dev/mps/mps_sas_lsi.c Fri Dec 21 20:12:43 2018 (r342353) +++ head/sys/dev/mps/mps_sas_lsi.c Fri Dec 21 20:29:16 2018 (r342354) @@ -818,6 +818,7 @@ out: for (i = 1; i < sc->num_reqs; i++) { cm = &sc->commands[i]; if (cm->cm_flags & MPS_CM_FLAGS_SATA_ID_TIMEOUT) { + free(cm->cm_data, M_MPT2); mps_free_command(sc, cm); } } @@ -1000,15 +1001,15 @@ mpssas_get_sata_identify(struct mps_softc *sc, u16 han out: /* * If the SATA_ID_TIMEOUT flag has been set for this command, don't free - * it. The command will be freed after sending a target reset TM. If - * the command did timeout, use EWOULDBLOCK. + * it. The command and buffer will be freed after sending an Abort + * Task TM. If the command did timeout, use EWOULDBLOCK. */ if ((cm != NULL) - && (cm->cm_flags & MPS_CM_FLAGS_SATA_ID_TIMEOUT) == 0) + && (cm->cm_flags & MPS_CM_FLAGS_SATA_ID_TIMEOUT) == 0) { mps_free_command(sc, cm); - else if (error == 0) + free(buffer, M_MPT2); + } else if (error == 0) error = EWOULDBLOCK; - free(buffer, M_MPT2); return (error); }