Date: Wed, 3 Dec 2014 08:25:42 +0000 (UTC) From: Alexander Motin <mav@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r275446 - head/sys/cam/ctl Message-ID: <201412030825.sB38Pg0t056241@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mav Date: Wed Dec 3 08:25:41 2014 New Revision: 275446 URL: https://svnweb.freebsd.org/changeset/base/275446 Log: Plug memory leaks on UNMAP and XCOPY with invalid parameters. MFC after: 1 week Modified: head/sys/cam/ctl/ctl.c head/sys/cam/ctl/ctl_tpc.c Modified: head/sys/cam/ctl/ctl.c ============================================================================== --- head/sys/cam/ctl/ctl.c Wed Dec 3 08:22:13 2014 (r275445) +++ head/sys/cam/ctl/ctl.c Wed Dec 3 08:25:41 2014 (r275446) @@ -5904,8 +5904,7 @@ ctl_unmap(struct ctl_scsiio *ctsio) /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0); - ctl_done((union ctl_io *)ctsio); - return (CTL_RETVAL_COMPLETE); + goto done; } len = scsi_2btoul(hdr->desc_length); buf = (struct scsi_unmap_desc *)(hdr + 1); @@ -5932,8 +5931,7 @@ ctl_unmap(struct ctl_scsiio *ctsio) len = (uint8_t *)endnz - (uint8_t *)buf; if (len == 0) { ctl_set_success(ctsio); - ctl_done((union ctl_io *)ctsio); - return (CTL_RETVAL_COMPLETE); + goto done; } mtx_lock(&lun->lun_lock); @@ -5947,6 +5945,14 @@ ctl_unmap(struct ctl_scsiio *ctsio) retval = lun->backend->config_write((union ctl_io *)ctsio); return (retval); + +done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } + ctl_done((union ctl_io *)ctsio); + return (CTL_RETVAL_COMPLETE); } /* Modified: head/sys/cam/ctl/ctl_tpc.c ============================================================================== --- head/sys/cam/ctl/ctl_tpc.c Wed Dec 3 08:22:13 2014 (r275445) +++ head/sys/cam/ctl/ctl_tpc.c Wed Dec 3 08:25:41 2014 (r275446) @@ -1644,6 +1644,10 @@ ctl_extended_copy_lid1(struct ctl_scsiio return (CTL_RETVAL_COMPLETE); done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -1767,6 +1771,10 @@ ctl_extended_copy_lid4(struct ctl_scsiio return (CTL_RETVAL_COMPLETE); done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -1944,8 +1952,10 @@ ctl_populate_token(struct ctl_scsiio *ct return (CTL_RETVAL_COMPLETE); done: - if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -2069,8 +2079,10 @@ ctl_write_using_token(struct ctl_scsiio return (CTL_RETVAL_COMPLETE); done: - if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201412030825.sB38Pg0t056241>