diff options
author | Tony Battersby <tonyb@cybernetics.com> | 2015-07-16 11:40:41 -0400 |
---|---|---|
committer | James Bottomley <JBottomley@Odin.com> | 2015-07-30 13:40:33 -0400 |
commit | 0c958ecc69c277b25f38f72bc6d18ab145e8167c (patch) | |
tree | bc2bad55954762cbafac0651b2250675762e890b | |
parent | 3f1c0581310d5d94bd72740231507e763a6252a4 (diff) |
scsi: fix memory leak with scsi-mq
Fix a memory leak with scsi-mq triggered by commands with large data
transfer length.
__sg_alloc_table() sets both table->nents and table->orig_nents to the
same value. When the scatterlist is DMA-mapped, table->nents is
overwritten with the (possibly smaller) size of the DMA-mapped
scatterlist, while table->orig_nents retains the original size of the
allocated scatterlist. scsi_free_sgtable() should therefore check
orig_nents instead of nents, and all code that initializes sdb->table
without calling __sg_alloc_table() should set both nents and orig_nents.
Fixes: d285203cf647 ("scsi: add support for a blk-mq based I/O path.")
Cc: <stable@vger.kernel.org> # 3.17+
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
-rw-r--r-- | drivers/scsi/scsi_error.c | 2 | ||||
-rw-r--r-- | drivers/scsi/scsi_lib.c | 6 |
2 files changed, 4 insertions, 4 deletions
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index 106884a5444e..cfadccef045c 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c | |||
@@ -944,7 +944,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses, | |||
944 | scmd->sdb.length); | 944 | scmd->sdb.length); |
945 | scmd->sdb.table.sgl = &ses->sense_sgl; | 945 | scmd->sdb.table.sgl = &ses->sense_sgl; |
946 | scmd->sc_data_direction = DMA_FROM_DEVICE; | 946 | scmd->sc_data_direction = DMA_FROM_DEVICE; |
947 | scmd->sdb.table.nents = 1; | 947 | scmd->sdb.table.nents = scmd->sdb.table.orig_nents = 1; |
948 | scmd->cmnd[0] = REQUEST_SENSE; | 948 | scmd->cmnd[0] = REQUEST_SENSE; |
949 | scmd->cmnd[4] = scmd->sdb.length; | 949 | scmd->cmnd[4] = scmd->sdb.length; |
950 | scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]); | 950 | scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]); |
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c index b1a263137a23..448ebdaa3d69 100644 --- a/drivers/scsi/scsi_lib.c +++ b/drivers/scsi/scsi_lib.c | |||
@@ -583,7 +583,7 @@ static struct scatterlist *scsi_sg_alloc(unsigned int nents, gfp_t gfp_mask) | |||
583 | 583 | ||
584 | static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq) | 584 | static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq) |
585 | { | 585 | { |
586 | if (mq && sdb->table.nents <= SCSI_MAX_SG_SEGMENTS) | 586 | if (mq && sdb->table.orig_nents <= SCSI_MAX_SG_SEGMENTS) |
587 | return; | 587 | return; |
588 | __sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free); | 588 | __sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free); |
589 | } | 589 | } |
@@ -597,8 +597,8 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, bool mq) | |||
597 | 597 | ||
598 | if (mq) { | 598 | if (mq) { |
599 | if (nents <= SCSI_MAX_SG_SEGMENTS) { | 599 | if (nents <= SCSI_MAX_SG_SEGMENTS) { |
600 | sdb->table.nents = nents; | 600 | sdb->table.nents = sdb->table.orig_nents = nents; |
601 | sg_init_table(sdb->table.sgl, sdb->table.nents); | 601 | sg_init_table(sdb->table.sgl, nents); |
602 | return 0; | 602 | return 0; |
603 | } | 603 | } |
604 | first_chunk = sdb->table.sgl; | 604 | first_chunk = sdb->table.sgl; |