[SCSI] Fix leak of Scsi_Cmnds

When a request is deferred in scsi_init_io because the sg table could not
be allocated, the associated scsi_cmnd is not released and the request is
not marked with REQ_DONTPREP.  When the command is retried, if
scsi_prep_fn decides to kill it then the scsi_cmnd will never be released.

This patch (as573) changes scsi_init_io so that it calls scsi_put_command
before deferring a request.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

1 files changed, 4 insertions, 3 deletions

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index dc9c772bc874..0074f28c37b2 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -97,7 +97,6 @@ int scsi_insert_special_req(struct scsi_request *sreq, int at_head)
 }
 
 static void scsi_run_queue(struct request_queue *q);
-static void scsi_release_buffers(struct scsi_cmnd *cmd);
 
 /*
  * Function:    scsi_unprep_request()
@@ -1040,8 +1039,10 @@ static int scsi_init_io(struct scsi_cmnd *cmd)
          * if sg table allocation fails, requeue request later.
          */
         sgpnt = scsi_alloc_sgtable(cmd, GFP_ATOMIC);
-        if (unlikely(!sgpnt))
+        if (unlikely(!sgpnt)) {
+                scsi_unprep_request(req);
                 return BLKPREP_DEFER;
+        }
 
         cmd->request_buffer = (char *) sgpnt;
         cmd->request_bufflen = req->nr_sectors << 9;
@@ -1245,8 +1246,8 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
                  */
                 ret = scsi_init_io(cmd);
                 switch(ret) {
+                        /* For BLKPREP_KILL/DEFER the cmd was released */
                 case BLKPREP_KILL:
-                        /* BLKPREP_KILL return also releases the command */
                         goto kill;
                 case BLKPREP_DEFER:
                         goto defer;