[SCSI] hpsa: fix memory leak in CCISS_BIG_PASSTHRU ioctl
We were leaking a command buffer if a DMA mapping error was encountered in the CCISS_BIG_PASSTHRU ioctl. Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com> Signed-off-by: James Bottomley <JBottomley@Parallels.com>
This commit is contained in:
parent
a4af4606db
commit
e2d4a1f6b4
|
@ -3170,7 +3170,7 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
|
||||||
hpsa_pci_unmap(h->pdev, c, i,
|
hpsa_pci_unmap(h->pdev, c, i,
|
||||||
PCI_DMA_BIDIRECTIONAL);
|
PCI_DMA_BIDIRECTIONAL);
|
||||||
status = -ENOMEM;
|
status = -ENOMEM;
|
||||||
goto cleanup1;
|
goto cleanup0;
|
||||||
}
|
}
|
||||||
c->SG[i].Addr.lower = temp64.val32.lower;
|
c->SG[i].Addr.lower = temp64.val32.lower;
|
||||||
c->SG[i].Addr.upper = temp64.val32.upper;
|
c->SG[i].Addr.upper = temp64.val32.upper;
|
||||||
|
@ -3186,24 +3186,23 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
|
||||||
/* Copy the error information out */
|
/* Copy the error information out */
|
||||||
memcpy(&ioc->error_info, c->err_info, sizeof(ioc->error_info));
|
memcpy(&ioc->error_info, c->err_info, sizeof(ioc->error_info));
|
||||||
if (copy_to_user(argp, ioc, sizeof(*ioc))) {
|
if (copy_to_user(argp, ioc, sizeof(*ioc))) {
|
||||||
cmd_special_free(h, c);
|
|
||||||
status = -EFAULT;
|
status = -EFAULT;
|
||||||
goto cleanup1;
|
goto cleanup0;
|
||||||
}
|
}
|
||||||
if (ioc->Request.Type.Direction == XFER_READ && ioc->buf_size > 0) {
|
if (ioc->Request.Type.Direction == XFER_READ && ioc->buf_size > 0) {
|
||||||
/* Copy the data out of the buffer we created */
|
/* Copy the data out of the buffer we created */
|
||||||
BYTE __user *ptr = ioc->buf;
|
BYTE __user *ptr = ioc->buf;
|
||||||
for (i = 0; i < sg_used; i++) {
|
for (i = 0; i < sg_used; i++) {
|
||||||
if (copy_to_user(ptr, buff[i], buff_size[i])) {
|
if (copy_to_user(ptr, buff[i], buff_size[i])) {
|
||||||
cmd_special_free(h, c);
|
|
||||||
status = -EFAULT;
|
status = -EFAULT;
|
||||||
goto cleanup1;
|
goto cleanup0;
|
||||||
}
|
}
|
||||||
ptr += buff_size[i];
|
ptr += buff_size[i];
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
cmd_special_free(h, c);
|
|
||||||
status = 0;
|
status = 0;
|
||||||
|
cleanup0:
|
||||||
|
cmd_special_free(h, c);
|
||||||
cleanup1:
|
cleanup1:
|
||||||
if (buff) {
|
if (buff) {
|
||||||
for (i = 0; i < sg_used; i++)
|
for (i = 0; i < sg_used; i++)
|
||||||
|
|
Loading…
Reference in a new issue