Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b4c2554d authored by Martin K. Petersen's avatar Martin K. Petersen Committed by James Bottomley
Browse files

[SCSI] Fix protection scsi_data_buffer leak 



We would leak a scsi_data_buffer if the free_list command was of the
protected variety.

Reported-by: default avatarBoaz Harrosh <bharrosh@panasas.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Cc: Stable Tree <stable@kernel.org>
Signed-off-by: default avatarJames Bottomley <James.Bottomley@suse.de>
parent 35e1a5d9

drivers/scsi/scsi.c

+7 −4
Original line number Diff line number Diff line
@@ -241,10 +241,7 @@ scsi_host_alloc_command(struct Scsi_Host *shost, gfp_t gfp_mask) 
 */

struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)

{

	struct scsi_cmnd *cmd;

	unsigned char *buf;



	cmd = scsi_host_alloc_command(shost, gfp_mask);

	struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask);



	if (unlikely(!cmd)) {

		unsigned long flags;
@@ -258,9 +255,15 @@ struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask) 
		spin_unlock_irqrestore(&shost->free_list_lock, flags);



		if (cmd) {

			void *buf, *prot;



			buf = cmd->sense_buffer;

			prot = cmd->prot_sdb;



			memset(cmd, 0, sizeof(*cmd));



			cmd->sense_buffer = buf;

			cmd->prot_sdb = prot;

		}

	}