raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

scsi: fix memory leak with scsi-mq

Browse Source 
commit 0c958ecc69 upstream.

Fix a memory leak with scsi-mq triggered by commands with large data
transfer length.

__sg_alloc_table() sets both table->nents and table->orig_nents to the
same value.  When the scatterlist is DMA-mapped, table->nents is
overwritten with the (possibly smaller) size of the DMA-mapped
scatterlist, while table->orig_nents retains the original size of the
allocated scatterlist.  scsi_free_sgtable() should therefore check
orig_nents instead of nents, and all code that initializes sdb->table
without calling __sg_alloc_table() should set both nents and orig_nents.

Fixes: d285203cf6 ("scsi: add support for a blk-mq based I/O path.")
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Tony Battersby
2015-07-16 11:40:41 -04:00
committed by Greg Kroah-Hartman
parent a77aa615ba
commit cb6fd3e6f1
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/scsi/scsi_error.c
View File

@@ -944,7 +944,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
scmd->sdb.length); scmd->sdb.length);
scmd->sdb.table.sgl = &ses->sense_sgl; scmd->sdb.table.sgl = &ses->sense_sgl;
scmd->sc_data_direction = DMA_FROM_DEVICE; scmd->sc_data_direction = DMA_FROM_DEVICE;
scmd->sdb.table.nents = 1; scmd->sdb.table.nents = scmd->sdb.table.orig_nents = 1;
scmd->cmnd[0] = REQUEST_SENSE; scmd->cmnd[0] = REQUEST_SENSE;
scmd->cmnd[4] = scmd->sdb.length; scmd->cmnd[4] = scmd->sdb.length;
scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]); scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);

6
drivers/scsi/scsi_lib.c
View File

@@ -583,7 +583,7 @@ static struct scatterlist *scsi_sg_alloc(unsigned int nents, gfp_t gfp_mask)
static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq) static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq)
{ {
if (mq && sdb->table.nents <= SCSI_MAX_SG_SEGMENTS) if (mq && sdb->table.orig_nents <= SCSI_MAX_SG_SEGMENTS)
return; return;
__sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free); __sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free);
} }
@@ -597,8 +597,8 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, bool mq)
if (mq) { if (mq) {
if (nents <= SCSI_MAX_SG_SEGMENTS) { if (nents <= SCSI_MAX_SG_SEGMENTS) {
sdb->table.nents = nents; sdb->table.nents = sdb->table.orig_nents = nents;
sg_init_table(sdb->table.sgl, sdb->table.nents); sg_init_table(sdb->table.sgl, nents);
return 0; return 0;
} }
first_chunk = sdb->table.sgl; first_chunk = sdb->table.sgl;