mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 08:19:28 +00:00
scsi: core: free sgtables in case command setup fails
In case scsi_setup_fs_cmnd() fails we're not freeing the sgtables allocated by scsi_init_io(), thus we leak the allocated memory. Free the sgtables allocated by scsi_init_io() in case scsi_setup_fs_cmnd() fails. Technically scsi_setup_scsi_cmnd() does not suffer from this problem as it can only fail if scsi_init_io() fails, so it does not have sgtables allocated. But to maintain symmetry and as a measure of defensive programming, free the sgtables on scsi_setup_scsi_cmnd() failure as well. scsi_mq_free_sgtables() has safeguards against double-freeing of memory so this is safe to do. While we're at it, rename scsi_mq_free_sgtables() to scsi_free_sgtables(). Link: https://bugzilla.kernel.org/show_bug.cgi?id=205595 Link: https://lore.kernel.org/r/20200428104605.8143-2-johannes.thumshirn@wdc.com Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Daniel Wagner <dwagner@suse.de> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
parent
ea941016ab
commit
20a66f2bf2
1 changed files with 11 additions and 5 deletions
|
@ -531,7 +531,7 @@ static void scsi_uninit_cmd(struct scsi_cmnd *cmd)
|
|||
}
|
||||
}
|
||||
|
||||
static void scsi_mq_free_sgtables(struct scsi_cmnd *cmd)
|
||||
static void scsi_free_sgtables(struct scsi_cmnd *cmd)
|
||||
{
|
||||
if (cmd->sdb.table.nents)
|
||||
sg_free_table_chained(&cmd->sdb.table,
|
||||
|
@ -543,7 +543,7 @@ static void scsi_mq_free_sgtables(struct scsi_cmnd *cmd)
|
|||
|
||||
static void scsi_mq_uninit_cmd(struct scsi_cmnd *cmd)
|
||||
{
|
||||
scsi_mq_free_sgtables(cmd);
|
||||
scsi_free_sgtables(cmd);
|
||||
scsi_uninit_cmd(cmd);
|
||||
}
|
||||
|
||||
|
@ -1032,7 +1032,7 @@ blk_status_t scsi_init_io(struct scsi_cmnd *cmd)
|
|||
|
||||
return BLK_STS_OK;
|
||||
out_free_sgtables:
|
||||
scsi_mq_free_sgtables(cmd);
|
||||
scsi_free_sgtables(cmd);
|
||||
return ret;
|
||||
}
|
||||
EXPORT_SYMBOL(scsi_init_io);
|
||||
|
@ -1163,6 +1163,7 @@ static blk_status_t scsi_setup_cmnd(struct scsi_device *sdev,
|
|||
struct request *req)
|
||||
{
|
||||
struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(req);
|
||||
blk_status_t ret;
|
||||
|
||||
if (!blk_rq_bytes(req))
|
||||
cmd->sc_data_direction = DMA_NONE;
|
||||
|
@ -1172,9 +1173,14 @@ static blk_status_t scsi_setup_cmnd(struct scsi_device *sdev,
|
|||
cmd->sc_data_direction = DMA_FROM_DEVICE;
|
||||
|
||||
if (blk_rq_is_scsi(req))
|
||||
return scsi_setup_scsi_cmnd(sdev, req);
|
||||
ret = scsi_setup_scsi_cmnd(sdev, req);
|
||||
else
|
||||
return scsi_setup_fs_cmnd(sdev, req);
|
||||
ret = scsi_setup_fs_cmnd(sdev, req);
|
||||
|
||||
if (ret != BLK_STS_OK)
|
||||
scsi_free_sgtables(cmd);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
static blk_status_t
|
||||
|
|
Loading…
Reference in a new issue