From: Dave Marquardt <[email protected]> The default: case of the protocol switch in ibmvfc_register_channel() jumps to irq_failed without setting rc, leaving a stale value from h_reg_sub_crq() (0 or H_CLOSED) that the caller sees as success even though the sub-CRQ was just freed. The mapping created by irq_create_mapping() is also never disposed, leaving scrq->irq non-zero.
Set rc = -EINVAL in the default: case. Introduce an irq_mapping_failed: label that calls irq_dispose_mapping() and clears scrq->irq before falling through to irq_failed, and jump to it from both the default: case and the request_irq() failure path, eliminating the duplicate inline dispose/clear in the latter. Signed-off-by: Dave Marquardt <[email protected]> --- drivers/scsi/ibmvscsi/ibmvfc-core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/ibmvscsi/ibmvfc-core.c b/drivers/scsi/ibmvscsi/ibmvfc-core.c index 65829c3d2eea..77c685f6f959 100644 --- a/drivers/scsi/ibmvscsi/ibmvfc-core.c +++ b/drivers/scsi/ibmvscsi/ibmvfc-core.c @@ -6429,16 +6429,15 @@ static int ibmvfc_register_channel(struct ibmvfc_host *vhost, default: dev_err(dev, "Unknown channel protocol (%d)\n", channels->protocol); - goto irq_failed; + rc = -EINVAL; + goto irq_mapping_failed; } rc = request_irq(scrq->irq, scrq->handler, 0, scrq->name, scrq); if (rc) { dev_err(dev, "Couldn't register sub-crq[%d] irq\n", index); - irq_dispose_mapping(scrq->irq); - scrq->irq = 0; - goto irq_failed; + goto irq_mapping_failed; } scrq->hwq_id = index; @@ -6446,6 +6445,9 @@ static int ibmvfc_register_channel(struct ibmvfc_host *vhost, LEAVE; return 0; +irq_mapping_failed: + irq_dispose_mapping(scrq->irq); + scrq->irq = 0; irq_failed: do { hcall_rc = plpar_hcall_norets(H_FREE_SUB_CRQ, vdev->unit_address, scrq->cookie); -- 2.56.0
