[PATCH 0/5] scsi: elx: efct: fix resources stranded on failure paths

[Ali Ahmet Memis <ali@iusegentoo.com>]

Five places in efct take a resource and then return an error without
giving it back. Three of them lose an entry from a fixed size pool, which
stops the driver working once the pool is empty rather than growing
memory; the other two are ordinary leaks.

  1  efct_els_hw_srrs_send() checks hw->state after taking an HIO
  2  the WQE builders in efct_els_hw_srrs_send() and efct_hw_bls_send()
  3  the WQE builder in efct_hw_send_frame(), which loses a request tag
  4  efct_hw_rx_buffer_alloc() drops the coherent buffers it mapped
  5  efct_hw_setup() leaves its two mempools behind

Patch 5 is the one I could exercise. Binding the driver to a PCI device
that is not an SLI-4 adapter makes sli_setup() fail after the mempools
have been created, and efct_pci_probe() then frees the struct efct that
held the only pointers to them. Repeating that probe 61 times under
CONFIG_DEBUG_KMEMLEAK:

  before   1566 unreferenced objects, every one from efct_hw_setup()
  after    none, and the probe still fails the same way

Patches 1 to 4 are reasoned from the code. They need a real Emulex SLI-4
adapter, and for 1 to 3 a live FC link as well, which I do not have. Each
patch builds on its own.

I deliberately left the efct_hw_wq_write() failure paths alone.
efct_hw_wq_write() appends to wq->pending_list and drains from the head,
so it can return an error while this request is still linked there.
Releasing the HIO or the request tag at that point would leave a later
completion looking at something that has been handed back, which needs
more than a free on the error path.

Also not addressed here: efct_xport_attach() and efct_xport_initialize()
return without efct_hw_teardown() on some paths, and efcport_init() leaves
its first two pools behind when the third allocation fails. Those cross
two modules and I would rather send them separately once this is settled.

Ali Ahmet Memis (5):
  scsi: elx: efct: check the HW state before allocating an HIO
  scsi: elx: efct: free the HIO when the WQE cannot be built
  scsi: elx: efct: free the request tag when the send frame WQE fails
  scsi: elx: efct: free the RQ buffers already allocated when one fails
  scsi: elx: efct: destroy the mailbox pools when setup fails

 drivers/scsi/elx/efct/efct_hw.c | 71 +++++++++++++++++++++------------
 1 file changed, 45 insertions(+), 26 deletions(-)


base-commit: 0d839570765118029aa8bf4a95444c6a11aacf85
-- 
2.55.0