Commit 77c51ba5 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 

Pull SCSI fixes from James Bottomley:
 "Five small fixes, all in drivers.

  Most of these are error leg freeing issues, with the only really user
  visible one being the zfcp fix"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: iscsi: Fix possible memory leak when device_register() failed
  scsi: zfcp: Fix double free of FSF request when qdio send fails
  scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper()
  scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus()
  scsi: mpi3mr: Suppress command reply debug prints
parents b6e7fdfd f014165f

drivers/s390/scsi/zfcp_fsf.c

+1 −1
Original line number Diff line number Diff line
@@ -884,7 +884,7 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req) 
	const bool is_srb = zfcp_fsf_req_is_status_read_buffer(req);

	struct zfcp_adapter *adapter = req->adapter;

	struct zfcp_qdio *qdio = adapter->qdio;

	int req_id = req->req_id;

	unsigned long req_id = req->req_id;



	zfcp_reqlist_add(adapter->req_list, req);

drivers/scsi/mpi3mr/mpi3mr_os.c

+2 −1
Original line number Diff line number Diff line
@@ -3265,7 +3265,8 @@ void mpi3mr_process_op_reply_desc(struct mpi3mr_ioc *mrioc, 
	}



	if (scmd->result != (DID_OK << 16) && (scmd->cmnd[0] != ATA_12) &&

	    (scmd->cmnd[0] != ATA_16)) {

	    (scmd->cmnd[0] != ATA_16) &&

	    mrioc->logging_level & MPI3_DEBUG_SCSI_ERROR) {

		ioc_info(mrioc, "%s :scmd->result 0x%x\n", __func__,

		    scmd->result);

		scsi_print_command(scmd);

drivers/scsi/scsi_debug.c

+5 −1
Original line number Diff line number Diff line
@@ -7323,8 +7323,12 @@ static int sdebug_add_host_helper(int per_host_idx) 
	dev_set_name(&sdbg_host->dev, "adapter%d", sdebug_num_hosts);



	error = device_register(&sdbg_host->dev);

	if (error)

	if (error) {

		spin_lock(&sdebug_host_list_lock);

		list_del(&sdbg_host->host_list);

		spin_unlock(&sdebug_host_list_lock);

		goto clean;

	}



	++sdebug_num_hosts;

	return 0;

drivers/scsi/scsi_transport_iscsi.c

+16 −15
Original line number Diff line number Diff line
@@ -231,7 +231,7 @@ iscsi_create_endpoint(int dd_size) 
	dev_set_name(&ep->dev, "ep-%d", id);

	err = device_register(&ep->dev);

        if (err)

		goto free_id;

		goto put_dev;



	err = sysfs_create_group(&ep->dev.kobj, &iscsi_endpoint_group);

	if (err)
@@ -245,10 +245,12 @@ iscsi_create_endpoint(int dd_size) 
	device_unregister(&ep->dev);

	return NULL;



free_id:

put_dev:

	mutex_lock(&iscsi_ep_idr_mutex);

	idr_remove(&iscsi_ep_idr, id);

	mutex_unlock(&iscsi_ep_idr_mutex);

	put_device(&ep->dev);

	return NULL;

free_ep:

	kfree(ep);

	return NULL;
@@ -766,7 +768,7 @@ iscsi_create_iface(struct Scsi_Host *shost, struct iscsi_transport *transport, 


	err = device_register(&iface->dev);

	if (err)

		goto free_iface;

		goto put_dev;



	err = sysfs_create_group(&iface->dev.kobj, &iscsi_iface_group);

	if (err)
@@ -780,9 +782,8 @@ iscsi_create_iface(struct Scsi_Host *shost, struct iscsi_transport *transport, 
	device_unregister(&iface->dev);

	return NULL;



free_iface:

	put_device(iface->dev.parent);

	kfree(iface);

put_dev:

	put_device(&iface->dev);

	return NULL;

}

EXPORT_SYMBOL_GPL(iscsi_create_iface);
@@ -1251,15 +1252,15 @@ iscsi_create_flashnode_sess(struct Scsi_Host *shost, int index, 


	err = device_register(&fnode_sess->dev);

	if (err)

		goto free_fnode_sess;

		goto put_dev;



	if (dd_size)

		fnode_sess->dd_data = &fnode_sess[1];



	return fnode_sess;



free_fnode_sess:

	kfree(fnode_sess);

put_dev:

	put_device(&fnode_sess->dev);

	return NULL;

}

EXPORT_SYMBOL_GPL(iscsi_create_flashnode_sess);
@@ -1299,15 +1300,15 @@ iscsi_create_flashnode_conn(struct Scsi_Host *shost, 


	err = device_register(&fnode_conn->dev);

	if (err)

		goto free_fnode_conn;

		goto put_dev;



	if (dd_size)

		fnode_conn->dd_data = &fnode_conn[1];



	return fnode_conn;



free_fnode_conn:

	kfree(fnode_conn);

put_dev:

	put_device(&fnode_conn->dev);

	return NULL;

}

EXPORT_SYMBOL_GPL(iscsi_create_flashnode_conn);
@@ -4815,7 +4816,7 @@ iscsi_register_transport(struct iscsi_transport *tt) 
	dev_set_name(&priv->dev, "%s", tt->name);

	err = device_register(&priv->dev);

	if (err)

		goto free_priv;

		goto put_dev;



	err = sysfs_create_group(&priv->dev.kobj, &iscsi_transport_group);

	if (err)
@@ -4850,8 +4851,8 @@ iscsi_register_transport(struct iscsi_transport *tt) 
unregister_dev:

	device_unregister(&priv->dev);

	return NULL;

free_priv:

	kfree(priv);

put_dev:

	put_device(&priv->dev);

	return NULL;

}

EXPORT_SYMBOL_GPL(iscsi_register_transport);

drivers/target/loopback/tcm_loop.c

+2 −1
Original line number Diff line number Diff line
@@ -397,6 +397,7 @@ static int tcm_loop_setup_hba_bus(struct tcm_loop_hba *tl_hba, int tcm_loop_host 
	ret = device_register(&tl_hba->dev);

	if (ret) {

		pr_err("device_register() failed for tl_hba->dev: %d\n", ret);

		put_device(&tl_hba->dev);

		return -ENODEV;

	}
@@ -1073,7 +1074,7 @@ static struct se_wwn *tcm_loop_make_scsi_hba( 
	 */

	ret = tcm_loop_setup_hba_bus(tl_hba, tcm_loop_hba_no_cnt);

	if (ret)

		goto out;

		return ERR_PTR(ret);



	sh = tl_hba->sh;

	tcm_loop_hba_no_cnt++;