Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b57221a2 authored by Bo Wu's avatar Bo Wu Committed by Greg Kroah-Hartman
Browse files

scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func 

[ Upstream commit 9a1b0b9a6dab452fb0e39fe96880c4faf3878369 ]

When phba->mbox_ext_buf_ctx.seqNum != phba->mbox_ext_buf_ctx.numBuf,
dd_data should be freed before return SLI_CONFIG_HANDLED.

When lpfc_sli_issue_mbox func return fails, pmboxq should be also freed in
job_error tag.

Link: https://lore.kernel.org/r/EDBAAA0BBBA2AC4E9C8B6B81DEEE1D6915E7A966@DGGEML525-MBS.china.huawei.com


Signed-off-by: default avatarBo Wu <wubo40@huawei.com>
Reviewed-by: default avatarZhiqiang Liu <liuzhiqiang26@huawei.com>
Reviewed-by: default avatarJames Smart <james.smart@broadcom.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 71427eda

drivers/scsi/lpfc/lpfc_bsg.c

+9 −6
Original line number Diff line number Diff line
@@ -4419,12 +4419,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, 
	phba->mbox_ext_buf_ctx.seqNum++;

	nemb_tp = phba->mbox_ext_buf_ctx.nembType;



	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);

	if (!dd_data) {

		rc = -ENOMEM;

		goto job_error;

	}



	pbuf = (uint8_t *)dmabuf->virt;

	size = job->request_payload.payload_len;

	sg_copy_to_buffer(job->request_payload.sg_list,
@@ -4461,6 +4455,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, 
				"2968 SLI_CONFIG ext-buffer wr all %d "

				"ebuffers received\n",

				phba->mbox_ext_buf_ctx.numBuf);



		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);

		if (!dd_data) {

			rc = -ENOMEM;

			goto job_error;

		}



		/* mailbox command structure for base driver */

		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);

		if (!pmboxq) {
@@ -4509,6 +4510,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job, 
	return SLI_CONFIG_HANDLED;



job_error:

	if (pmboxq)

		mempool_free(pmboxq, phba->mbox_mem_pool);

	lpfc_bsg_dma_page_free(phba, dmabuf);

	kfree(dd_data);