linux-kernel - [PATCH] scsi: lpfc: Fix memleak in lpfc_nvmet_setup_io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 28 Dec 2023 11:22:17 +0800
From: Dinghao Liu <dinghao.liu@....edu.cn>
To: dinghao.liu@....edu.cn
Cc: James Smart <james.smart@...adcom.com>,
	Dick Kennedy <dick.kennedy@...adcom.com>,
	"James E.J. Bottomley" <jejb@...ux.ibm.com>,
	"Martin K. Petersen" <martin.petersen@...cle.com>,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] scsi: lpfc: Fix memleak in lpfc_nvmet_setup_io_context

lpfc_nvmet_setup_io_context() allocates memory for
phba->sli4_hba.nvmet_ctx_info, but does not free it in
the following error handling paths, which may lead to
a memleak.

Fixes: 66d7ce93a0f5 ("scsi: lpfc: Fix MRQ > 1 context list handling")
Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>
---
 drivers/scsi/lpfc/lpfc_nvmet.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 425328d9c2d8..9131a04aea28 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1556,6 +1556,8 @@ lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
 	for (i = 0; i < phba->sli4_hba.nvmet_xri_cnt; i++) {
 		ctx_buf = kzalloc(sizeof(*ctx_buf), GFP_KERNEL);
 		if (!ctx_buf) {
+			kfree(phba->sli4_hba.nvmet_ctx_info);
+			phba->sli4_hba.nvmet_ctx_info = NULL;
 			lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
 					"6404 Ran out of memory for NVMET\n");
 			return -ENOMEM;
@@ -1565,6 +1567,8 @@ lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
 					   GFP_KERNEL);
 		if (!ctx_buf->context) {
 			kfree(ctx_buf);
+			kfree(phba->sli4_hba.nvmet_ctx_info);
+			phba->sli4_hba.nvmet_ctx_info = NULL;
 			lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
 					"6405 Ran out of NVMET "
 					"context memory\n");
@@ -1577,6 +1581,8 @@ lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
 		if (!ctx_buf->iocbq) {
 			kfree(ctx_buf->context);
 			kfree(ctx_buf);
+			kfree(phba->sli4_hba.nvmet_ctx_info);
+			phba->sli4_hba.nvmet_ctx_info = NULL;
 			lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
 					"6406 Ran out of NVMET iocb/WQEs\n");
 			return -ENOMEM;
@@ -1596,6 +1602,8 @@ lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
 			lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
 			kfree(ctx_buf->context);
 			kfree(ctx_buf);
+			kfree(phba->sli4_hba.nvmet_ctx_info);
+			phba->sli4_hba.nvmet_ctx_info = NULL;
 			lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
 					"6407 Ran out of NVMET XRIs\n");
 			return -ENOMEM;
-- 
2.17.1