Fix possible memory leak in error path of storvsc_queuecommand() when DMA mapping fails.
Unified · Split
| @@ -1850,8 +1850,10 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) · 1849 unmodified lines | |||
| 1850 | payload->range.offset = offset_in_hvpg; | 1850 | payload->range.offset = offset_in_hvpg; |
| 1851 | 1851 | ||
| 1852 | sg_count = scsi_dma_map(scmnd); | 1852 | sg_count = scsi_dma_map(scmnd); |
| 1853 | if (sg_count < 0) | 1853 | if (sg_count < 0) { |
| 1854 | return SCSI_MLQUEUE_DEVICE_BUSY; | 1854 | ret = SCSI_MLQUEUE_DEVICE_BUSY; |
| 1855 | goto err_free_payload; | ||
| 1856 | } | ||
| 1855 | 1857 | ||
| 1856 | for_each_sg(sgl, sg, sg_count, j) { | 1858 | for_each_sg(sgl, sg, sg_count, j) { |
| 1857 | /* | 1859 | /* |
| @@ -1886,13 +1888,18 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) · 28 unmodified lines | |||
| 1886 | put_cpu(); | 1888 | put_cpu(); |
| 1887 | 1889 | ||
| 1888 | if (ret == -EAGAIN) { | 1890 | if (ret == -EAGAIN) { |
| 1889 | if (payload_sz > sizeof(cmd_request->mpb)) | ||
| 1890 | kfree(payload); | ||
| 1891 | /* no more space */ | 1891 | /* no more space */ |
| 1892 | return SCSI_MLQUEUE_DEVICE_BUSY; | 1892 | ret = SCSI_MLQUEUE_DEVICE_BUSY; |
| 1893 | goto err_free_payload; | ||
| 1893 | } | 1894 | } |
| 1894 | 1895 | ||
| 1895 | return 0; | 1896 | return 0; |
| 1897 | |||
| 1898 | err_free_payload: | ||
| 1899 | if (payload_sz > sizeof(cmd_request->mpb)) | ||
| 1900 | kfree(payload); | ||
| 1901 | |||
| 1902 | return ret; | ||
| 1896 | } | 1903 | } |
| 1897 | 1904 | ||
| 1898 | static struct scsi_host_template scsi_driver = { | 1905 | static struct scsi_host_template scsi_driver = { |