scsi: core: free sgtables in case command setup fails (20a66f2b) · Commits · 戴 / test

In case scsi_setup_fs_cmnd() fails we're not freeing the sgtables allocated by scsi_init_io(), thus we leak the allocated memory. Free the sgtables allocated by scsi_init_io() in case scsi_setup_fs_cmnd() fails. Technically scsi_setup_scsi_cmnd() does not suffer from this problem as it can only fail if scsi_init_io() fails, so it does not have sgtables allocated. But to maintain symmetry and as a measure of defensive programming, free the sgtables on scsi_setup_scsi_cmnd() failure as well. scsi_mq_free_sgtables() has safeguards against double-freeing of memory so this is safe to do. While we're at it, rename scsi_mq_free_sgtables() to scsi_free_sgtables(). Link: https://bugzilla.kernel.org/show_bug.cgi?id=205595 Link: https://lore.kernel.org/r/20200428104605.8143-2-johannes.thumshirn@wdc.com Reviewed-by:

Christoph Hellwig <hch@lst.de> Reviewed-by:

Daniel Wagner <dwagner@suse.de> Reviewed-by:

Hannes Reinecke <hare@suse.de> Signed-off-by:

Johannes Thumshirn <johannes.thumshirn@wdc.com> Signed-off-by:

Martin K. Petersen <martin.petersen@oracle.com>

drivers/scsi/scsi_lib.c

+11 −5

Original line number	Diff line number	Diff line
		@@ -531,7 +531,7 @@ static void scsi_uninit_cmd(struct scsi_cmnd *cmd)
		}
		}

		static void scsi_mq_free_sgtables(struct scsi_cmnd *cmd)
		static void scsi_free_sgtables(struct scsi_cmnd *cmd)
		{
		if (cmd->sdb.table.nents)
		sg_free_table_chained(&cmd->sdb.table,
		@@ -543,7 +543,7 @@ static void scsi_mq_free_sgtables(struct scsi_cmnd *cmd)

		static void scsi_mq_uninit_cmd(struct scsi_cmnd *cmd)
		{
		scsi_mq_free_sgtables(cmd);
		scsi_free_sgtables(cmd);
		scsi_uninit_cmd(cmd);
		}

		@@ -1032,7 +1032,7 @@ blk_status_t scsi_init_io(struct scsi_cmnd *cmd)

		return BLK_STS_OK;
		out_free_sgtables:
		scsi_mq_free_sgtables(cmd);
		scsi_free_sgtables(cmd);
		return ret;
		}
		EXPORT_SYMBOL(scsi_init_io);
		@@ -1163,6 +1163,7 @@ static blk_status_t scsi_setup_cmnd(struct scsi_device *sdev,
		struct request *req)
		{
		struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(req);
		blk_status_t ret;

		if (!blk_rq_bytes(req))
		cmd->sc_data_direction = DMA_NONE;
		@@ -1172,9 +1173,14 @@ static blk_status_t scsi_setup_cmnd(struct scsi_device *sdev,
		cmd->sc_data_direction = DMA_FROM_DEVICE;

		if (blk_rq_is_scsi(req))
		return scsi_setup_scsi_cmnd(sdev, req);
		ret = scsi_setup_scsi_cmnd(sdev, req);
		else
		return scsi_setup_fs_cmnd(sdev, req);
		ret = scsi_setup_fs_cmnd(sdev, req);

		if (ret != BLK_STS_OK)
		scsi_free_sgtables(cmd);

		return ret;
		}

		static blk_status_t

Admin message