beiscsi_alloc_mem() builds each memory descriptor from DMA chunks
recorded in the temporary mem_arr_orig array. After all chunks for the
current descriptor have been allocated, the code allocates
mem_descr->mem_array and copies the temporary descriptors into it.

If mem_descr->mem_array allocation fails, or if DMA allocation fails
after some chunks have been allocated for the current descriptor, the
error path records the current chunk count in mem_descr->num_elements and
then dereferences mem_descr->mem_array. That pointer has not been
allocated for the current descriptor, so the cleanup path can dereference
NULL and also fail to release the current DMA chunks.

Release the current descriptor chunks from mem_arr_orig first, then walk
backward over the descriptors that were fully initialized earlier.

Fixes: 6733b39a1301 ("[SCSI] be2iscsi: add 10Gbps iSCSI - BladeEngine 2 driver")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/scsi/be2iscsi/be_main.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
index fd18d4d3d..31c617bb6 100644
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -2549,8 +2549,18 @@ static int beiscsi_alloc_mem(struct beiscsi_hba *phba)
 	kfree(mem_arr_orig);
 	return 0;
 free_mem:
-	mem_descr->num_elements = j;
-	while ((i) || (j)) {
+	while (j) {
+		j--;
+		bus_add = mem_arr_orig[j].bus_address.u.a64.address;
+		dma_free_coherent(&phba->pcidev->dev,
+				  mem_arr_orig[j].size,
+				  mem_arr_orig[j].virtual_address,
+				  bus_add);
+	}
+
+	while (i) {
+		i--;
+		mem_descr--;
 		for (j = mem_descr->num_elements; j > 0; j--) {
 			dma_free_coherent(&phba->pcidev->dev,
 					    mem_descr->mem_array[j - 1].size,
@@ -2560,11 +2570,7 @@ free_mem:
 					    mem_array[j - 1].
 					    bus_address.u.a64.address);
 		}
-		if (i) {
-			i--;
-			kfree(mem_descr->mem_array);
-			mem_descr--;
-		}
+		kfree(mem_descr->mem_array);
 	}
 	kfree(mem_arr_orig);
 	kfree(phba->init_mem);
-- 
2.51.0