linux-kernel - Re: [PATCH] scsi: storvsc: Fix storvsc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 Jan 2022 11:56:08 +0000
From:   Wei Liu <wei.liu@...nel.org>
To:     Juan Vazquez <juvazq@...ux.microsoft.com>
Cc:     kys@...rosoft.com, haiyangz@...rosoft.com, sthemmin@...rosoft.com,
        wei.liu@...nel.org, decui@...rosoft.com, mikelley@...rosoft.com,
        jejb@...ux.ibm.com, martin.petersen@...cle.com,
        linux-hyperv@...r.kernel.org, linux-scsi@...r.kernel.org,
        linux-kernel@...r.kernel.org, tianyu.lan@...rosoft.com,
        longli@...rosoft.com
Subject: Re: [PATCH] scsi: storvsc: Fix storvsc_queuecommand() memory leak

On Sat, Jan 08, 2022 at 04:17:58PM -0800, Juan Vazquez wrote:
> Fix possible memory leak in error path of storvsc_queuecommand() when
> DMA mapping fails.
> 
> Fixes: 743b237c3a7b ("scsi: storvsc: Add Isolation VM support for storvsc driver")
> Signed-off-by: Juan Vazquez <juvazq@...ux.microsoft.com>

Martin, I can pick this up since the offending commit is not yet in
Linus' tree.

Tianyu, Long and Michael, the change makes sense to me but can you give
an ack or review here?

> ---
>  drivers/scsi/storvsc_drv.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
> index 2273b843d9d2..9a0bba5a51a7 100644
> --- a/drivers/scsi/storvsc_drv.c
> +++ b/drivers/scsi/storvsc_drv.c
> @@ -1850,8 +1850,10 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
>  		payload->range.offset = offset_in_hvpg;
>  
>  		sg_count = scsi_dma_map(scmnd);
> -		if (sg_count < 0)
> -			return SCSI_MLQUEUE_DEVICE_BUSY;
> +		if (sg_count < 0) {
> +			ret = SCSI_MLQUEUE_DEVICE_BUSY;
> +			goto err_free_payload;
> +		}
>  
>  		for_each_sg(sgl, sg, sg_count, j) {
>  			/*
> @@ -1886,13 +1888,18 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
>  	put_cpu();
>  
>  	if (ret == -EAGAIN) {
> -		if (payload_sz > sizeof(cmd_request->mpb))
> -			kfree(payload);
>  		/* no more space */
> -		return SCSI_MLQUEUE_DEVICE_BUSY;
> +		ret = SCSI_MLQUEUE_DEVICE_BUSY;
> +		goto err_free_payload;
>  	}
>  
>  	return 0;
> +
> +err_free_payload:
> +	if (payload_sz > sizeof(cmd_request->mpb))
> +		kfree(payload);
> +
> +	return ret;
>  }
>  
>  static struct scsi_host_template scsi_driver = {
> -- 
> 2.32.0
>