Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d335e605 authored by Nicholas Bellinger's avatar Nicholas Bellinger
Browse files

iscsi-target: Fix iscsit_alloc_buffs() failure cases 



Make iscsit_alloc_buffs() failure case for page_alloc_failed use correct
__free_page() SGL pointer, and return -ENOMEM for iscsit_allocate_iovecs
failure to push se_cmd->t_mem_sg release into iscsit_release_cmd()
callback during iscsit_add_reject_from_cmd() connection reset.

Also drop cmd->t_mem_sg = NULL assignment from page_alloc_failed
failure case.

Reported-by: default avatarRoland Dreier <roland@purestorage.com>
Cc: Andy Grover <agrover@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 33395fb8

drivers/target/iscsi/iscsi_target.c

+6 −8
Original line number Diff line number Diff line
@@ -780,7 +780,7 @@ static int iscsit_alloc_buffs(struct iscsi_cmd *cmd) 
	struct scatterlist *sgl;

	u32 length = cmd->se_cmd.data_length;

	int nents = DIV_ROUND_UP(length, PAGE_SIZE);

	int i = 0, ret;

	int i = 0, j = 0, ret;

	/*

	 * If no SCSI payload is present, allocate the default iovecs used for

	 * iSCSI PDU Header
@@ -821,17 +821,15 @@ static int iscsit_alloc_buffs(struct iscsi_cmd *cmd) 
	 */

        ret = iscsit_allocate_iovecs(cmd);

        if (ret < 0)

		goto page_alloc_failed;

		return -ENOMEM;



	return 0;



page_alloc_failed:

	while (i >= 0) {

		__free_page(sg_page(&sgl[i]));

		i--;

	}

	kfree(cmd->t_mem_sg);

	cmd->t_mem_sg = NULL;

	while (j < i)

		__free_page(sg_page(&sgl[j++]));



	kfree(sgl);

	return -ENOMEM;

}