diff options
| author | mav <mav@FreeBSD.org> | 2014-12-10 08:52:47 +0000 |
|---|---|---|
| committer | mav <mav@FreeBSD.org> | 2014-12-10 08:52:47 +0000 |
| commit | 4875c0a2054728926c5384b2812d593178eeabfd (patch) | |
| tree | 9575f41f18ad7a6acd064c78802f591074e95f44 | |
| parent | b24390d7fc2b53f72a3836b662dcb05a1e026666 (diff) | |
| download | FreeBSD-src-4875c0a2054728926c5384b2812d593178eeabfd.zip FreeBSD-src-4875c0a2054728926c5384b2812d593178eeabfd.tar.gz | |
MFC r275446: Plug memory leaks on UNMAP and XCOPY with invalid parameters.
| -rw-r--r-- | sys/cam/ctl/ctl.c | 14 | ||||
| -rw-r--r-- | sys/cam/ctl/ctl_tpc.c | 16 |
2 files changed, 24 insertions, 6 deletions
diff --git a/sys/cam/ctl/ctl.c b/sys/cam/ctl/ctl.c index e0d9cc1..86ddf4d 100644 --- a/sys/cam/ctl/ctl.c +++ b/sys/cam/ctl/ctl.c @@ -6166,8 +6166,7 @@ ctl_unmap(struct ctl_scsiio *ctsio) /*field*/ 0, /*bit_valid*/ 0, /*bit*/ 0); - ctl_done((union ctl_io *)ctsio); - return (CTL_RETVAL_COMPLETE); + goto done; } len = scsi_2btoul(hdr->desc_length); buf = (struct scsi_unmap_desc *)(hdr + 1); @@ -6194,8 +6193,7 @@ ctl_unmap(struct ctl_scsiio *ctsio) len = (uint8_t *)endnz - (uint8_t *)buf; if (len == 0) { ctl_set_success(ctsio); - ctl_done((union ctl_io *)ctsio); - return (CTL_RETVAL_COMPLETE); + goto done; } mtx_lock(&lun->lun_lock); @@ -6209,6 +6207,14 @@ ctl_unmap(struct ctl_scsiio *ctsio) retval = lun->backend->config_write((union ctl_io *)ctsio); return (retval); + +done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } + ctl_done((union ctl_io *)ctsio); + return (CTL_RETVAL_COMPLETE); } /* diff --git a/sys/cam/ctl/ctl_tpc.c b/sys/cam/ctl/ctl_tpc.c index 60ae8a0..2b82212 100644 --- a/sys/cam/ctl/ctl_tpc.c +++ b/sys/cam/ctl/ctl_tpc.c @@ -1678,6 +1678,10 @@ ctl_extended_copy_lid1(struct ctl_scsiio *ctsio) return (CTL_RETVAL_COMPLETE); done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -1801,6 +1805,10 @@ ctl_extended_copy_lid4(struct ctl_scsiio *ctsio) return (CTL_RETVAL_COMPLETE); done: + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { + free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -1978,8 +1986,10 @@ ctl_populate_token(struct ctl_scsiio *ctsio) return (CTL_RETVAL_COMPLETE); done: - if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } @@ -2103,8 +2113,10 @@ ctl_write_using_token(struct ctl_scsiio *ctsio) return (CTL_RETVAL_COMPLETE); done: - if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) + if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) { free(ctsio->kern_data_ptr, M_CTL); + ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED; + } ctl_done((union ctl_io *)ctsio); return (CTL_RETVAL_COMPLETE); } |
