summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAsias He <asias@redhat.com>2013-04-10 15:06:14 +0800
committerNicholas Bellinger <nab@linux-iscsi.org>2013-04-11 01:48:27 -0700
commit7ea206cf3b06704cf2bfc9c9c395094b24dc44a2 (patch)
treea270c2a06611ddd9d062ef01ed5df54fb911e752
parentf6da51c3ef07c593a410551af4cad093e2fbe755 (diff)
tcm_vhost: Fix tv_cmd leak in vhost_scsi_handle_vq
If we fail to submit the allocated tv_vmd to tcm_vhost_submission_work, we will leak the tv_vmd. Free tv_vmd on fail path. Signed-off-by: Asias He <asias@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
-rw-r--r--drivers/vhost/tcm_vhost.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index 28c112f23830..210d59e222fc 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -724,7 +724,7 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
" exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n",
scsi_command_size(tv_cmd->tvc_cdb),
TCM_VHOST_MAX_CDB_SIZE);
- break; /* TODO */
+ goto err;
}
tv_cmd->tvc_lun = ((v_req.lun[2] << 8) | v_req.lun[3]) & 0x3FFF;
@@ -737,7 +737,7 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
data_direction == DMA_TO_DEVICE);
if (unlikely(ret)) {
vq_err(vq, "Failed to map iov to sgl\n");
- break; /* TODO */
+ goto err;
}
}
@@ -758,6 +758,11 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs,
}
mutex_unlock(&vq->mutex);
+ return;
+
+err:
+ vhost_scsi_free_cmd(tv_cmd);
+ mutex_unlock(&vq->mutex);
}
static void vhost_scsi_ctl_handle_kick(struct vhost_work *work)