diff options
| author | Stephen M. Cameron <scameron@beardog.cce.hp.com> | 2013-09-23 20:33:51 +0200 |
|---|---|---|
| committer | James Bottomley <JBottomley@Parallels.com> | 2013-12-16 19:57:53 +0100 |
| commit | e2d4a1f6b497e39d68775378960ad27be4f86250 (patch) | |
| tree | ff624082307842cb4089d193b4a4e725fa699cca /drivers/scsi/hpsa.c | |
| parent | [SCSI] hpsa: remove unneeded include of seq_file.h (diff) | |
| download | linux-e2d4a1f6b497e39d68775378960ad27be4f86250.tar.xz linux-e2d4a1f6b497e39d68775378960ad27be4f86250.zip | |
[SCSI] hpsa: fix memory leak in CCISS_BIG_PASSTHRU ioctl
We were leaking a command buffer if a DMA mapping error was
encountered in the CCISS_BIG_PASSTHRU ioctl.
Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Diffstat (limited to 'drivers/scsi/hpsa.c')
| -rw-r--r-- | drivers/scsi/hpsa.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c index bb3ee8fd2a3d..f12f55669cb3 100644 --- a/drivers/scsi/hpsa.c +++ b/drivers/scsi/hpsa.c @@ -3170,7 +3170,7 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp) hpsa_pci_unmap(h->pdev, c, i, PCI_DMA_BIDIRECTIONAL); status = -ENOMEM; - goto cleanup1; + goto cleanup0; } c->SG[i].Addr.lower = temp64.val32.lower; c->SG[i].Addr.upper = temp64.val32.upper; @@ -3186,24 +3186,23 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp) /* Copy the error information out */ memcpy(&ioc->error_info, c->err_info, sizeof(ioc->error_info)); if (copy_to_user(argp, ioc, sizeof(*ioc))) { - cmd_special_free(h, c); status = -EFAULT; - goto cleanup1; + goto cleanup0; } if (ioc->Request.Type.Direction == XFER_READ && ioc->buf_size > 0) { /* Copy the data out of the buffer we created */ BYTE __user *ptr = ioc->buf; for (i = 0; i < sg_used; i++) { if (copy_to_user(ptr, buff[i], buff_size[i])) { - cmd_special_free(h, c); status = -EFAULT; - goto cleanup1; + goto cleanup0; } ptr += buff_size[i]; } } - cmd_special_free(h, c); status = 0; +cleanup0: + cmd_special_free(h, c); cleanup1: if (buff) { for (i = 0; i < sg_used; i++) |