Skip to content

Commit 41b3731

Browse files
GoodLuck612martinkpetersen
authored andcommitted
scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
pqi_report_phys_luns() fails to release the rpl_list buffer when encountering an unsupported data format or when the allocation for rpl_16byte_wwid_list fails. These early returns bypass the cleanup logic, leading to memory leaks. Consolidate the error handling by adding an out_free_rpl_list label and use goto statements to ensure rpl_list is consistently freed on failure. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: 28ca6d8 ("scsi: smartpqi: Add extended report physical LUNs") Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Tested-by: Don Brace <don.brace@microchip.com> Acked-by: Don Brace <don.brace@microchip.com> Link: https://patch.msgid.link/20260131093641.1008117-1-zilin@seu.edu.cn Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
1 parent 21a16f0 commit 41b3731

1 file changed

Lines changed: 10 additions & 3 deletions

File tree

drivers/scsi/smartpqi/smartpqi_init.c

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1241,7 +1241,8 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b
12411241
dev_err(&ctrl_info->pci_dev->dev,
12421242
"RPL returned unsupported data format %u\n",
12431243
rpl_response_format);
1244-
return -EINVAL;
1244+
rc = -EINVAL;
1245+
goto out_free_rpl_list;
12451246
} else {
12461247
dev_warn(&ctrl_info->pci_dev->dev,
12471248
"RPL returned extended format 2 instead of 4\n");
@@ -1253,8 +1254,10 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b
12531254

12541255
rpl_16byte_wwid_list = kmalloc(struct_size(rpl_16byte_wwid_list, lun_entries,
12551256
num_physicals), GFP_KERNEL);
1256-
if (!rpl_16byte_wwid_list)
1257-
return -ENOMEM;
1257+
if (!rpl_16byte_wwid_list) {
1258+
rc = -ENOMEM;
1259+
goto out_free_rpl_list;
1260+
}
12581261

12591262
put_unaligned_be32(num_physicals * sizeof(struct report_phys_lun_16byte_wwid),
12601263
&rpl_16byte_wwid_list->header.list_length);
@@ -1275,6 +1278,10 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b
12751278
*buffer = rpl_16byte_wwid_list;
12761279

12771280
return 0;
1281+
1282+
out_free_rpl_list:
1283+
kfree(rpl_list);
1284+
return rc;
12781285
}
12791286

12801287
static inline int pqi_report_logical_luns(struct pqi_ctrl_info *ctrl_info, void **buffer)

0 commit comments

Comments
 (0)