linux-kernel - [PATCH] scsi: qla2xxx: Fix memory leak in qlt_get_port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251228125519.3687097-1-zilin@seu.edu.cn>
Date: Sun, 28 Dec 2025 12:55:19 +0000
From: Zilin Guan <zilin@....edu.cn>
To: njavali@...vell.com
Cc: GR-QLogic-Storage-Upstream@...vell.com,
	James.Bottomley@...senPartnership.com,
	martin.petersen@...cle.com,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Zilin Guan <zilin@....edu.cn>,
	Jianhao Xu <jianhao.xu@....edu.cn>
Subject: [PATCH] scsi: qla2xxx: Fix memory leak in qlt_get_port_database()

In qlt_get_port_database(), qla2x00_alloc_fcport() internally calls
dma_alloc_coherent() to allocate fcport->ct_desc.ct_sns. If
qla24xx_gpdb_wait() fails, the function only frees fcport but not
fcport->ct_desc.ct_sns, which leads to a memory leak.

Fix this by replacing kfree() with qla2x00_free_fcport() in this error
case.

Fixes: 2d70c103fd2a ("[SCSI] qla2xxx: Add LLD target-mode infrastructure for >= 24xx series")
Co-developed-by: Jianhao Xu <jianhao.xu@....edu.cn>
Signed-off-by: Jianhao Xu <jianhao.xu@....edu.cn>
Signed-off-by: Zilin Guan <zilin@....edu.cn>
---
 drivers/scsi/qla2xxx/qla_target.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index d772136984c9..bf48a7b0509f 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -7210,7 +7210,7 @@ static fc_port_t *qlt_get_port_database(struct scsi_qla_host *vha,
 		    "qla_target(%d): Failed to retrieve fcport "
 		    "information -- get_port_database() returned %x "
 		    "(loop_id=0x%04x)", vha->vp_idx, rc, loop_id);
-		kfree(fcport);
+		qla2x00_free_fcport(fcport);
 		return NULL;
 	}
 
-- 
2.34.1