Commit 20a66f2b authored by Johannes Thumshirn's avatar Johannes Thumshirn Committed by Martin K. Petersen
Browse files

scsi: core: free sgtables in case command setup fails 

In case scsi_setup_fs_cmnd() fails we're not freeing the sgtables allocated
by scsi_init_io(), thus we leak the allocated memory.

Free the sgtables allocated by scsi_init_io() in case scsi_setup_fs_cmnd()
fails.

Technically scsi_setup_scsi_cmnd() does not suffer from this problem as it
can only fail if scsi_init_io() fails, so it does not have sgtables
allocated. But to maintain symmetry and as a measure of defensive
programming, free the sgtables on scsi_setup_scsi_cmnd() failure as well.
scsi_mq_free_sgtables() has safeguards against double-freeing of memory so
this is safe to do.

While we're at it, rename scsi_mq_free_sgtables() to scsi_free_sgtables().

Link: https://bugzilla.kernel.org/show_bug.cgi?id=205595
Link: https://lore.kernel.org/r/20200428104605.8143-2-johannes.thumshirn@wdc.com


Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarDaniel Wagner <dwagner@suse.de>
Reviewed-by: default avatarHannes Reinecke <hare@suse.de>
Signed-off-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent ea941016

drivers/scsi/scsi_lib.c

+11 −5
Original line number Diff line number Diff line
@@ -531,7 +531,7 @@ static void scsi_uninit_cmd(struct scsi_cmnd *cmd) 
	}

}



static void scsi_mq_free_sgtables(struct scsi_cmnd *cmd)

static void scsi_free_sgtables(struct scsi_cmnd *cmd)

{

	if (cmd->sdb.table.nents)

		sg_free_table_chained(&cmd->sdb.table,
@@ -543,7 +543,7 @@ static void scsi_mq_free_sgtables(struct scsi_cmnd *cmd) 


static void scsi_mq_uninit_cmd(struct scsi_cmnd *cmd)

{

	scsi_mq_free_sgtables(cmd);

	scsi_free_sgtables(cmd);

	scsi_uninit_cmd(cmd);

}
@@ -1032,7 +1032,7 @@ blk_status_t scsi_init_io(struct scsi_cmnd *cmd) 


	return BLK_STS_OK;

out_free_sgtables:

	scsi_mq_free_sgtables(cmd);

	scsi_free_sgtables(cmd);

	return ret;

}

EXPORT_SYMBOL(scsi_init_io);
@@ -1163,6 +1163,7 @@ static blk_status_t scsi_setup_cmnd(struct scsi_device *sdev, 
		struct request *req)

{

	struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(req);

	blk_status_t ret;



	if (!blk_rq_bytes(req))

		cmd->sc_data_direction = DMA_NONE;
@@ -1172,9 +1173,14 @@ static blk_status_t scsi_setup_cmnd(struct scsi_device *sdev, 
		cmd->sc_data_direction = DMA_FROM_DEVICE;



	if (blk_rq_is_scsi(req))

		return scsi_setup_scsi_cmnd(sdev, req);

		ret = scsi_setup_scsi_cmnd(sdev, req);

	else

		return scsi_setup_fs_cmnd(sdev, req);

		ret = scsi_setup_fs_cmnd(sdev, req);



	if (ret != BLK_STS_OK)

		scsi_free_sgtables(cmd);



	return ret;

}



static blk_status_t