Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 610a6349 authored by FUJITA Tomonori's avatar FUJITA Tomonori Committed by Jens Axboe
Browse files

scsi: fix discard page leak 



We leak a page allocated for discard on some error conditions
(e.g. scsi_prep_state_check returns BLKPREP_DEFER in
scsi_setup_blk_pc_cmnd).

We unprep on requests that weren't prepped in the error path of
scsi_init_io. It makes the error path to clean up scsi commands messy.

Let's strictly apply the rule that we can't unprep on a request that
wasn't prepped.

Calling just scsi_put_command() in the error path of scsi_init_io() is
enough. We don't set REQ_DONTPREP yet.

scsi_setup_discard_cmnd can safely free a page on the error case with
the above rule.

Signed-off-by: default avatarFUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: default avatarJens Axboe <jaxboe@fusionio.com>
parent 9e094383

drivers/scsi/scsi_lib.c

+2 −5
Original line number Diff line number Diff line
@@ -1011,11 +1011,8 @@ int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask) 


err_exit:

	scsi_release_buffers(cmd);

	if (error == BLKPREP_KILL)

	scsi_put_command(cmd);

	else /* BLKPREP_DEFER */

		scsi_unprep_request(cmd->request);



	cmd->request->special = NULL;

	return error;

}

EXPORT_SYMBOL(scsi_init_io);

drivers/scsi/sd.c

+8 −2
Original line number Diff line number Diff line
@@ -468,6 +468,10 @@ static int scsi_setup_discard_cmnd(struct scsi_device *sdp, struct request *rq) 
	blk_add_request_payload(rq, page, len);

	ret = scsi_setup_blk_pc_cmnd(sdp, rq);

	rq->buffer = page_address(page);

	if (ret != BLKPREP_OK) {

		__free_page(page);

		rq->buffer = NULL;

	}

	return ret;

}
@@ -485,8 +489,10 @@ static int scsi_setup_flush_cmnd(struct scsi_device *sdp, struct request *rq) 


static void sd_unprep_fn(struct request_queue *q, struct request *rq)

{

	if (rq->cmd_flags & REQ_DISCARD)

		__free_page(virt_to_page(rq->buffer));

	if (rq->cmd_flags & REQ_DISCARD) {

		free_page((unsigned long)rq->buffer);

		rq->buffer = NULL;

	}

}



/**