From owner-svn-src-all@FreeBSD.ORG Wed Dec 10 08:52:49 2014 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 2F5FBCF6; Wed, 10 Dec 2014 08:52:49 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 10B9EDD7; Wed, 10 Dec 2014 08:52:49 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id sBA8qmLt047853; Wed, 10 Dec 2014 08:52:48 GMT (envelope-from mav@FreeBSD.org) Received: (from mav@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id sBA8qm5w047847; Wed, 10 Dec 2014 08:52:48 GMT (envelope-from mav@FreeBSD.org) Message-Id: <201412100852.sBA8qm5w047847@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: mav set sender to mav@FreeBSD.org using -f From: Alexander Motin Date: Wed, 10 Dec 2014 08:52:48 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r275673 - stable/10/sys/cam/ctl X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Dec 2014 08:52:49 -0000 Author: mav Date: Wed Dec 10 08:52:47 2014 New Revision: 275673 URL: https://svnweb.freebsd.org/changeset/base/275673 Log: MFC r275446: Plug memory leaks on UNMAP and XCOPY with invalid parameters. Modified: stable/10/sys/cam/ctl/ctl.c stable/10/sys/cam/ctl/ctl_tpc.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/cam/ctl/ctl.c ============================================================================== --- stable/10/sys/cam/ctl/ctl.c Wed Dec 10 08:36:40 2014 (r275672) +++ stable/10/sys/cam/ctl/ctl.c Wed Dec 10 08:52:47 2014 (r275673) @@ -6166,8 +6166,7 @@ ctl_unmap(struct ctl_scsiio *ctsio) /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0); - ctl_done((union ctl_io *)ctsio); - return (CTL_RETVAL_COMPLETE); + goto done; } len = scsi_2btoul(hdr->desc_length); buf = (struct scsi_unmap_desc *)(hdr + 1); @@ -6194,8 +6193,7 @@ ctl_unmap(struct ctl_scsiio *ctsio) len = (uint8_t *)endnz - (uint8_t *)buf; if (len == 0) { ctl_set_success(ctsio); - ctl_done((union ctl_io *)ctsio); - return (CTL_RETVAL_COMPLETE); + goto done; } mtx_lock(&lun->lun_lock); @@ -6209,6 +6207,14 @@ ctl_unmap(struct ctl_scsiio *ctsio) retval = lun->backend->config_write((union ctl_io *)ctsio); return (retval); + +done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } + ctl_done((union ctl_io *)ctsio); + return (CTL_RETVAL_COMPLETE); } /* Modified: stable/10/sys/cam/ctl/ctl_tpc.c ============================================================================== --- stable/10/sys/cam/ctl/ctl_tpc.c Wed Dec 10 08:36:40 2014 (r275672) +++ stable/10/sys/cam/ctl/ctl_tpc.c Wed Dec 10 08:52:47 2014 (r275673) @@ -1678,6 +1678,10 @@ ctl_extended_copy_lid1(struct ctl_scsiio return (CTL_RETVAL_COMPLETE); done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -1801,6 +1805,10 @@ ctl_extended_copy_lid4(struct ctl_scsiio return (CTL_RETVAL_COMPLETE); done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -1978,8 +1986,10 @@ ctl_populate_token(struct ctl_scsiio *ct return (CTL_RETVAL_COMPLETE); done: - if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -2103,8 +2113,10 @@ ctl_write_using_token(struct ctl_scsiio return (CTL_RETVAL_COMPLETE); done: - if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); }