Skip to contentSkip to conversation

scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()

PATCH Applied Rafael Mendonca 3 participants 3 messages Sep 14, 2022 – Sep 16, 2022

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()

Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG") made the __qlt_24xx_handle_abts() function return early if tcm_qla2xxx_find_cmd_by_tag() doesn't find a command, but it missed to clean up the allocated memory for the management command in such a case.

Fixes 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG")
---
 drivers/scsi/qla2xxx/qla_target.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_target.c +3 -1
index 62666df1a59e..4acff4e84b90 100644
@@ -2151,8 +2151,10 @@ static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha,
 
 	abort_cmd = ha->tgt.tgt_ops->find_cmd_by_tag(sess,
 				le32_to_cpu(abts->exchange_addr_to_abort));
-	if (!abort_cmd)
+	if (!abort_cmd) {
+		mempool_free(mcmd, qla_tgt_mgmt_cmd_mempool);
 		return -EIO;
+	}
 	mcmd->unpacked_lun = abort_cmd->se_cmd.orig_fe_lun;
 
 	if (abort_cmd->qpair) {
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 34 lines · Rafael Mendonca

Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG") made the __qlt_24xx_handle_abts() function return early if tcm_qla2xxx_find_cmd_by_tag() doesn't find a command, but it missed to clean up the allocated memory for the management command in such a case.

Fixes 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG")

---
drivers/scsi/qla2xxx/qla_target.c | 4 +++-

1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/qla2xxx/qla_target.c +3 -1
index 62666df1a59e..4acff4e84b90 100644
@@ -2151,8 +2151,10 @@ static int __qlt_24xx_handle_abts(struct scsi_qla_host *vha,
 
 	abort_cmd = ha->tgt.tgt_ops->find_cmd_by_tag(sess,
 				le32_to_cpu(abts->exchange_addr_to_abort));
-	if (!abort_cmd)
+	if (!abort_cmd) {
+		mempool_free(mcmd, qla_tgt_mgmt_cmd_mempool);
 		return -EIO;
+	}
 	mcmd->unpacked_lun = abort_cmd->se_cmd.orig_fe_lun;
 
 	if (abort_cmd->qpair) {
Signature · 1 line
2.34.1

Looks Good.

Signature · 1 line
Himanshu Madhani	Oracle Linux Engineering
#2 lore raw
In reply to Rafael Mendonca
Quoted 6 lines · Rafael Mendonca

Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG") made the __qlt_24xx_handle_abts() function return early if tcm_qla2xxx_find_cmd_by_tag() doesn't find a command, but it missed to clean up the allocated memory for the management command in such a case.

Applied to 6.0/scsi-fixes, thanks!

[1/1] scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()

      https://git.kernel.org/mkp/scsi/c/601be20fc6a1
Signature · 1 line
Martin K. Petersen	Oracle Linux Engineering