Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2d4a1f6 authored by Stephen M. Cameron's avatar Stephen M. Cameron Committed by James Bottomley
Browse files

[SCSI] hpsa: fix memory leak in CCISS_BIG_PASSTHRU ioctl 



We were leaking a command buffer if a DMA mapping error was
encountered in the CCISS_BIG_PASSTHRU ioctl.

Signed-off-by: default avatarStephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
parent a4af4606

drivers/scsi/hpsa.c

+5 −6
Original line number Original line Diff line number Diff line
@@ -3170,7 +3170,7 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp) 
				hpsa_pci_unmap(h->pdev, c, i,

				hpsa_pci_unmap(h->pdev, c, i,

					PCI_DMA_BIDIRECTIONAL);

					PCI_DMA_BIDIRECTIONAL);

				status = -ENOMEM;

				status = -ENOMEM;

				goto cleanup1;

				goto cleanup0;

			}

			}

			c->SG[i].Addr.lower = temp64.val32.lower;

			c->SG[i].Addr.lower = temp64.val32.lower;

			c->SG[i].Addr.upper = temp64.val32.upper;

			c->SG[i].Addr.upper = temp64.val32.upper;
@@ -3186,24 +3186,23 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp) 
	/* Copy the error information out */

	/* Copy the error information out */

	memcpy(&ioc->error_info, c->err_info, sizeof(ioc->error_info));

	memcpy(&ioc->error_info, c->err_info, sizeof(ioc->error_info));

	if (copy_to_user(argp, ioc, sizeof(*ioc))) {

	if (copy_to_user(argp, ioc, sizeof(*ioc))) {

		cmd_special_free(h, c);

		status = -EFAULT;

		status = -EFAULT;

		goto cleanup1;

		goto cleanup0;

	}

	}

	if (ioc->Request.Type.Direction == XFER_READ && ioc->buf_size > 0) {

	if (ioc->Request.Type.Direction == XFER_READ && ioc->buf_size > 0) {

		/* Copy the data out of the buffer we created */

		/* Copy the data out of the buffer we created */

		BYTE __user *ptr = ioc->buf;

		BYTE __user *ptr = ioc->buf;

		for (i = 0; i < sg_used; i++) {

		for (i = 0; i < sg_used; i++) {

			if (copy_to_user(ptr, buff[i], buff_size[i])) {

			if (copy_to_user(ptr, buff[i], buff_size[i])) {

				cmd_special_free(h, c);

				status = -EFAULT;

				status = -EFAULT;

				goto cleanup1;

				goto cleanup0;

			}

			}

			ptr += buff_size[i];

			ptr += buff_size[i];

		}

		}

	}

	}

	cmd_special_free(h, c);

	status = 0;

	status = 0;

cleanup0:

	cmd_special_free(h, c);

cleanup1:

cleanup1:

	if (buff) {

	if (buff) {

		for (i = 0; i < sg_used; i++)

		for (i = 0; i < sg_used; i++)