Fix possible memory leak in error path of storvsc_queuecommand() when DMA mapping fails.
Unified · Split
| @@ -1850,8 +1850,10 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) · 1849 unmodified lines | ||
| 1850 | 1850 | payload->range.offset = offset_in_hvpg; |
| 1851 | 1851 | |
| 1852 | 1852 | sg_count = scsi_dma_map(scmnd); |
| 1853 | − if (sg_count < 0) | |
| 1854 | − return SCSI_MLQUEUE_DEVICE_BUSY; | |
| 1853 | + if (sg_count < 0) { | |
| 1854 | + ret = SCSI_MLQUEUE_DEVICE_BUSY; | |
| 1855 | + goto err_free_payload; | |
| 1856 | + } | |
| 1855 | 1857 | |
| 1856 | 1858 | for_each_sg(sgl, sg, sg_count, j) { |
| 1857 | 1859 | /* |
| @@ -1886,13 +1888,18 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) · 28 unmodified lines | ||
| 1886 | 1888 | put_cpu(); |
| 1887 | 1889 | |
| 1888 | 1890 | if (ret == -EAGAIN) { |
| 1889 | − if (payload_sz > sizeof(cmd_request->mpb)) | |
| 1890 | − kfree(payload); | |
| 1891 | 1891 | /* no more space */ |
| 1892 | − return SCSI_MLQUEUE_DEVICE_BUSY; | |
| 1892 | + ret = SCSI_MLQUEUE_DEVICE_BUSY; | |
| 1893 | + goto err_free_payload; | |
| 1893 | 1894 | } |
| 1894 | 1895 | |
| 1895 | 1896 | return 0; |
| 1897 | + | |
| 1898 | +err_free_payload: | |
| 1899 | + if (payload_sz > sizeof(cmd_request->mpb)) | |
| 1900 | + kfree(payload); | |
| 1901 | + | |
| 1902 | + return ret; | |
| 1896 | 1903 | } |
| 1897 | 1904 | |
| 1898 | 1905 | static struct scsi_host_template scsi_driver = { |