Skip to contentSkip to conversation

scsi: dpt_i2o: fix memory leak

PATCH In review Kulikov Vasiliy 2 participants 3 messages Jul 14, 2010

Subsystems (2)
SCSI Kernel janitors
lore
Share & tools
lore

Kulikov Vasiliy

author
#0 lore raw

PATCH 1/1 scsi: dpt_i2o: fix memory leak

Free allocated memory if adpt_ioctl_to_context() failed.

Signed-off-by Kulikov Vasiliy <[email protected]>
---
 drivers/scsi/dpt_i2o.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
drivers/scsi/dpt_i2o.c +3 -1
index f2d4df1..dd9a43b 100644
@@ -1839,8 +1839,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
 	sg_offset = (msg[0]>>4)&0xf;
 	msg[2] = 0x40000000; // IOCTL context
 	msg[3] = adpt_ioctl_to_context(pHba, reply);
-	if (msg[3] = (u32)-1)
+	if (msg[3] = (u32)-1) {
+		kfree(reply);
 		return -EBUSY;
+	}
 
 	memset(sg_list,0, sizeof(sg_list[0])*pHba->sg_tablesize);
 	if(sg_offset) {
Signature · 1 line
1.7.0.4
#1 lore raw
Quoted 12 lines · Kulikov Vasiliy

Free allocated memory if adpt_ioctl_to_context() failed.

Signed-off-by Kulikov Vasiliy <[email protected]>
---
 drivers/scsi/dpt_i2o.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
drivers/scsi/dpt_i2o.c +0 -0
index f2d4df1..dd9a43b 100644

drivers/scsi/dpt_i2o.c static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg) · line 1841

Quoted 3 lines
drivers/scsi/dpt_i2o.c +0 -0
@@ -1839,8 +1839,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
 	sg_offset = (msg[0]>>4)&0xf;
 	msg[2] = 0x40000000; // IOCTL context
 	msg[3] = adpt_ioctl_to_context(pHba, reply);

This patch is wrong I'm afraid. adpt_ioctl_to_context() frees "reply" if there is an error.

regards,
dan carpenter

Quoted 9 lines
drivers/scsi/dpt_i2o.c +3 -1
-	if (msg[3] = (u32)-1)
+	if (msg[3] = (u32)-1) {
+		kfree(reply);
 		return -EBUSY;
+	}
 
 	memset(sg_list,0, sizeof(sg_list[0])*pHba->sg_tablesize);
 	if(sg_offset) {
author
#2 lore raw
Quoted 8 lines · Dan Carpenter
Quoted 7 lines · Kulikov Vasiliy

Free allocated memory if adpt_ioctl_to_context() failed.

Signed-off-by Kulikov Vasiliy <[email protected]>
---
 drivers/scsi/dpt_i2o.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
Quoted 11 lines

drivers/scsi/dpt_i2o.c static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg) · line 1841

Quoted 8 lines
drivers/scsi/dpt_i2o.c +0 -0
index f2d4df1..dd9a43b 100644
@@ -1839,8 +1839,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
 	sg_offset = (msg[0]>>4)&0xf;
 	msg[2] = 0x40000000; // IOCTL context
 	msg[3] = adpt_ioctl_to_context(pHba, reply);

This patch is wrong I'm afraid. adpt_ioctl_to_context() frees "reply" if there is an error.

Hmm right, but it is very strange coding style - function frees resources that it did not allocated on error and does not free them on success.

Please, ignore this patch. Sorry for the noise.