Commit 37e6ba00 authored by James Bottomley's avatar James Bottomley
Browse files

[SCSI] fix memory leak in initialization 



The root cause of the problem is the fact that dev_set_name() now
allocates storage instead of using the original array within the kobj.
That means that the SCSI assumption that if you haven't made the
containing object or any sub objects visible, you can just destroy it
(and its component devices) lock stock and barrel becomes false.

Fix this by doing the get of sdev_dev at parent time and thus do an
extra put of it in scsi_destroy_sdev() (and all other destruction
without add paths).

Reported-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent 2caa7318

drivers/scsi/scsi_scan.c

+2 −0
Original line number Diff line number Diff line
@@ -317,6 +317,7 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget, 
out_device_destroy:

	scsi_device_set_state(sdev, SDEV_DEL);

	transport_destroy_device(&sdev->sdev_gendev);

	put_device(&sdev->sdev_dev);

	put_device(&sdev->sdev_gendev);

out:

	if (display_failure_msg)
@@ -957,6 +958,7 @@ static inline void scsi_destroy_sdev(struct scsi_device *sdev) 
	if (sdev->host->hostt->slave_destroy)

		sdev->host->hostt->slave_destroy(sdev);

	transport_destroy_device(&sdev->sdev_gendev);

	put_device(&sdev->sdev_dev);

	put_device(&sdev->sdev_gendev);

}

drivers/scsi/scsi_sysfs.c

+2 −5
Original line number Diff line number Diff line
@@ -864,10 +864,6 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev) 
		goto clean_device;

	}



	/* take a reference for the sdev_dev; this is

	 * released by the sdev_class .release */

	get_device(&sdev->sdev_gendev);



	/* create queue files, which may be writable, depending on the host */

	if (sdev->host->hostt->change_queue_depth)

		error = device_create_file(&sdev->sdev_gendev, &sdev_attr_queue_depth_rw);
@@ -917,6 +913,7 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev) 


	device_del(&sdev->sdev_gendev);

	transport_destroy_device(&sdev->sdev_gendev);

	put_device(&sdev->sdev_dev);

	put_device(&sdev->sdev_gendev);



	return error;
@@ -1065,7 +1062,7 @@ void scsi_sysfs_device_initialize(struct scsi_device *sdev) 
		     sdev->host->host_no, sdev->channel, sdev->id, sdev->lun);



	device_initialize(&sdev->sdev_dev);

	sdev->sdev_dev.parent = &sdev->sdev_gendev;

	sdev->sdev_dev.parent = get_device(&sdev->sdev_gendev);

	sdev->sdev_dev.class = &sdev_class;

	dev_set_name(&sdev->sdev_dev, "%d:%d:%d:%d",

		     sdev->host->host_no, sdev->channel, sdev->id, sdev->lun);

CRA Git | Maintained and supported by SUSTech CRA and CCSE