scsi: dpt_i2o: fix memory leak
in [Kernel]
|
Prev: Add helper functions for time computation
Next: cfq-iosched: don't allow aliased requests to starve others
From: Dan Carpenter on 14 Jul 2010 15:10 On Wed, Jul 14, 2010 at 09:53:27PM +0400, Kulikov Vasiliy wrote: > Free allocated memory if adpt_ioctl_to_context() failed. > > Signed-off-by: Kulikov Vasiliy <segooon(a)gmail.com> > --- > drivers/scsi/dpt_i2o.c | 4 +++- > 1 files changed, 3 insertions(+), 1 deletions(-) > > diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c > index f2d4df1..dd9a43b 100644 > --- a/drivers/scsi/dpt_i2o.c > +++ b/drivers/scsi/dpt_i2o.c > @@ -1839,8 +1839,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg) > sg_offset = (msg[0]>>4)&0xf; > msg[2] = 0x40000000; // IOCTL context > msg[3] = adpt_ioctl_to_context(pHba, reply); This patch is wrong I'm afraid. adpt_ioctl_to_context() frees "reply" if there is an error. regards, dan carpenter > - if (msg[3] == (u32)-1) > + if (msg[3] == (u32)-1) { > + kfree(reply); > return -EBUSY; > + } > > memset(sg_list,0, sizeof(sg_list[0])*pHba->sg_tablesize); > if(sg_offset) { > -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Kulikov Vasiliy on 14 Jul 2010 15:10
On Wed, Jul 14, 2010 at 20:58 +0200, Dan Carpenter wrote: > On Wed, Jul 14, 2010 at 09:53:27PM +0400, Kulikov Vasiliy wrote: > > Free allocated memory if adpt_ioctl_to_context() failed. > > > > Signed-off-by: Kulikov Vasiliy <segooon(a)gmail.com> > > --- > > drivers/scsi/dpt_i2o.c | 4 +++- > > 1 files changed, 3 insertions(+), 1 deletions(-) > > > > diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c > > index f2d4df1..dd9a43b 100644 > > --- a/drivers/scsi/dpt_i2o.c > > +++ b/drivers/scsi/dpt_i2o.c > > @@ -1839,8 +1839,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg) > > sg_offset = (msg[0]>>4)&0xf; > > msg[2] = 0x40000000; // IOCTL context > > msg[3] = adpt_ioctl_to_context(pHba, reply); > > This patch is wrong I'm afraid. adpt_ioctl_to_context() frees "reply" if > there is an error. Hmm right, but it is very strange coding style - function frees resources that it did not allocated on error and does not free them on success. Please, ignore this patch. Sorry for the noise. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |