lkml.org 
[lkml]   [2020]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 03/91] scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func
    Date
    From: Bo Wu <wubo40@huawei.com>

    [ Upstream commit 9a1b0b9a6dab452fb0e39fe96880c4faf3878369 ]

    When phba->mbox_ext_buf_ctx.seqNum != phba->mbox_ext_buf_ctx.numBuf,
    dd_data should be freed before return SLI_CONFIG_HANDLED.

    When lpfc_sli_issue_mbox func return fails, pmboxq should be also freed in
    job_error tag.

    Link: https://lore.kernel.org/r/EDBAAA0BBBA2AC4E9C8B6B81DEEE1D6915E7A966@DGGEML525-MBS.china.huawei.com
    Signed-off-by: Bo Wu <wubo40@huawei.com>
    Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
    Reviewed-by: James Smart <james.smart@broadcom.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/lpfc/lpfc_bsg.c | 15 +++++++++------
    1 file changed, 9 insertions(+), 6 deletions(-)

    diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
    index 05dcc2abd541..99f06ac7bf4c 100644
    --- a/drivers/scsi/lpfc/lpfc_bsg.c
    +++ b/drivers/scsi/lpfc/lpfc_bsg.c
    @@ -4352,12 +4352,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct fc_bsg_job *job,
    phba->mbox_ext_buf_ctx.seqNum++;
    nemb_tp = phba->mbox_ext_buf_ctx.nembType;

    - dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
    - if (!dd_data) {
    - rc = -ENOMEM;
    - goto job_error;
    - }
    -
    pbuf = (uint8_t *)dmabuf->virt;
    size = job->request_payload.payload_len;
    sg_copy_to_buffer(job->request_payload.sg_list,
    @@ -4394,6 +4388,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct fc_bsg_job *job,
    "2968 SLI_CONFIG ext-buffer wr all %d "
    "ebuffers received\n",
    phba->mbox_ext_buf_ctx.numBuf);
    +
    + dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
    + if (!dd_data) {
    + rc = -ENOMEM;
    + goto job_error;
    + }
    +
    /* mailbox command structure for base driver */
    pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
    if (!pmboxq) {
    @@ -4441,6 +4442,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct fc_bsg_job *job,
    return SLI_CONFIG_HANDLED;

    job_error:
    + if (pmboxq)
    + mempool_free(pmboxq, phba->mbox_mem_pool);
    lpfc_bsg_dma_page_free(phba, dmabuf);
    kfree(dd_data);

    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-11 10:59    [W:3.460 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site