svn commit: r275446 - head/sys/cam/ctl
Alexander Motin
mav at FreeBSD.org
Wed Dec 3 08:25:43 UTC 2014
Author: mav
Date: Wed Dec 3 08:25:41 2014
New Revision: 275446
URL: https://svnweb.freebsd.org/changeset/base/275446
Log:
Plug memory leaks on UNMAP and XCOPY with invalid parameters.
MFC after: 1 week
Modified:
head/sys/cam/ctl/ctl.c
head/sys/cam/ctl/ctl_tpc.c
Modified: head/sys/cam/ctl/ctl.c
==============================================================================
--- head/sys/cam/ctl/ctl.c Wed Dec 3 08:22:13 2014 (r275445)
+++ head/sys/cam/ctl/ctl.c Wed Dec 3 08:25:41 2014 (r275446)
@@ -5904,8 +5904,7 @@ ctl_unmap(struct ctl_scsiio *ctsio)
/*field*/ 0,
/*bit_valid*/ 0,
/*bit*/ 0);
- ctl_done((union ctl_io *)ctsio);
- return (CTL_RETVAL_COMPLETE);
+ goto done;
}
len = scsi_2btoul(hdr->desc_length);
buf = (struct scsi_unmap_desc *)(hdr + 1);
@@ -5932,8 +5931,7 @@ ctl_unmap(struct ctl_scsiio *ctsio)
len = (uint8_t *)endnz - (uint8_t *)buf;
if (len == 0) {
ctl_set_success(ctsio);
- ctl_done((union ctl_io *)ctsio);
- return (CTL_RETVAL_COMPLETE);
+ goto done;
}
mtx_lock(&lun->lun_lock);
@@ -5947,6 +5945,14 @@ ctl_unmap(struct ctl_scsiio *ctsio)
retval = lun->backend->config_write((union ctl_io *)ctsio);
return (retval);
+
+done:
+ if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+ free(ctsio->kern_data_ptr, M_CTL);
+ ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+ }
+ ctl_done((union ctl_io *)ctsio);
+ return (CTL_RETVAL_COMPLETE);
}
/*
Modified: head/sys/cam/ctl/ctl_tpc.c
==============================================================================
--- head/sys/cam/ctl/ctl_tpc.c Wed Dec 3 08:22:13 2014 (r275445)
+++ head/sys/cam/ctl/ctl_tpc.c Wed Dec 3 08:25:41 2014 (r275446)
@@ -1644,6 +1644,10 @@ ctl_extended_copy_lid1(struct ctl_scsiio
return (CTL_RETVAL_COMPLETE);
done:
+ if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+ free(ctsio->kern_data_ptr, M_CTL);
+ ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+ }
ctl_done((union ctl_io *)ctsio);
return (CTL_RETVAL_COMPLETE);
}
@@ -1767,6 +1771,10 @@ ctl_extended_copy_lid4(struct ctl_scsiio
return (CTL_RETVAL_COMPLETE);
done:
+ if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+ free(ctsio->kern_data_ptr, M_CTL);
+ ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+ }
ctl_done((union ctl_io *)ctsio);
return (CTL_RETVAL_COMPLETE);
}
@@ -1944,8 +1952,10 @@ ctl_populate_token(struct ctl_scsiio *ct
return (CTL_RETVAL_COMPLETE);
done:
- if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED)
+ if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
free(ctsio->kern_data_ptr, M_CTL);
+ ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+ }
ctl_done((union ctl_io *)ctsio);
return (CTL_RETVAL_COMPLETE);
}
@@ -2069,8 +2079,10 @@ ctl_write_using_token(struct ctl_scsiio
return (CTL_RETVAL_COMPLETE);
done:
- if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED)
+ if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
free(ctsio->kern_data_ptr, M_CTL);
+ ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+ }
ctl_done((union ctl_io *)ctsio);
return (CTL_RETVAL_COMPLETE);
}
More information about the svn-src-all
mailing list