linux-kernel - [PATCH] scsi: lpfc: Fix potential memory leak in lpfcdiag_sli3_loop_post

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20221117023619.9565-1-niejianglei2021@163.com>
Date:   Thu, 17 Nov 2022 10:36:19 +0800
From:   Jianglei Nie <niejianglei2021@....com>
To:     james.smart@...adcom.com, dick.kennedy@...adcom.com,
        jejb@...ux.ibm.com, martin.petersen@...cle.com
Cc:     linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org,
        Jianglei Nie <niejianglei@...il.com>,
        Jianglei Nie <niejianglei2021@....com>
Subject: [PATCH] scsi: lpfc: Fix potential memory leak in lpfcdiag_sli3_loop_post_rxbufs()

From: Jianglei Nie <niejianglei@...il.com>

lpfcdiag_sli3_loop_post_rxbufs() allocates a memory chunk from "rxbuffer"
with diag_cmd_data_alloc(). The "rxbuffer" should be freed when gets some
error. But when the function gets some error and jump to
"err_post_rxbufs_exit",The "rxbuffer" is not released, which will lead to
a memory leak.

We should free the "rxbuffer" with diag_cmd_data_free() in
"err_post_rxbufs_exit" when the "rxbuffer" is not NULL.

Signed-off-by: Jianglei Nie <niejianglei2021@....com>
Signed-off-by: Jianglei Nie <niejianglei@...il.com>
---
 drivers/scsi/lpfc/lpfc_bsg.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
index 852b025e2fec..2693def758b7 100644
--- a/drivers/scsi/lpfc/lpfc_bsg.c
+++ b/drivers/scsi/lpfc/lpfc_bsg.c
@@ -2989,8 +2989,11 @@ static int lpfcdiag_sli3_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri,
 err_post_rxbufs_exit:
 
 	if (rxbmp) {
-		if (rxbmp->virt)
+		if (rxbmp->virt) {
+			if (rxbuffer != NULL)
+				diag_cmd_data_free(phba, rxbuffer);
 			lpfc_mbuf_free(phba, rxbmp->virt, rxbmp->phys);
+		}
 		kfree(rxbmp);
 	}
 
-- 
2.25.1