In qla2x00_probe_one() -> qla2x00_mem_alloc(), fields in variable ha is allocated and initialized. Fields ha->loop_id_map and ha->npiv_info are also allocated in this function, but are freed when the function encounters an error. Function qla2x00_probe_one() then calls qla2x00_mem_free() to handle the error, which frees the corresponding fields again. This results in double free of ha->loop_id_map and ha-> npiv_info, since the fields are not NULLed after freed the first time.

Fix this by storing NULL to the corresponding fields inside qla2x00_mem_alloc() error handlers.

Fixes: e4e3a2ce9556 ("scsi: qla2xxx: Add ability to autodetect SFP type") Fixes: b64b0e8fd964 ("[SCSI] qla2xxx: Pass in optional extended-initialization control block.") Cc: stable@vger.kernel.org Signed-off-by: Keita Suzuki keitasuzuki.park@sslab.ics.keio.ac.jp --- drivers/scsi/qla2xxx/qla_os.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index 762229d495a8..a0b40578dbc8 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -4396,6 +4396,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, ha->sfp_data, ha->sfp_data_dma); fail_sfp_data: kfree(ha->loop_id_map); + ha->loop_id_map = NULL; fail_loop_id_map: dma_pool_free(ha->s_dma_pool, ha->async_pd, ha->async_pd_dma); fail_async_pd: @@ -4404,6 +4405,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma); fail_ex_init_cb: kfree(ha->npiv_info); + ha->npiv_info = NULL; fail_npiv_info: dma_free_coherent(&ha->pdev->dev, ((*rsp)->length + 1) * sizeof(response_t), (*rsp)->ring, (*rsp)->dma);