diff options
| author | Christian Engelmayer <cengelma@gmx.at> | 2014-01-19 02:08:49 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2014-01-21 20:36:17 -0800 |
| commit | 17a05cca99d952f5b4766fa48a2703548966636a (patch) | |
| tree | 3ecdbd133cbeef9f4bc3fb0a8f1eea4f8e1defa5 /block/scsi_ioctl.c | |
| parent | 5837c80e870bc3b12ac6a98cdc9ce7a9522a8fb6 (diff) | |
| download | lwn-17a05cca99d952f5b4766fa48a2703548966636a.tar.gz lwn-17a05cca99d952f5b4766fa48a2703548966636a.zip | |
block: Fix memory leak in rw_copy_check_uvector() handling
Fix a memory leak in the error handling path of function sg_io()
that is used during the processing of scsi ioctl. Memory already
allocated by rw_copy_check_uvector() needs to be freed correctly.
Detected by Coverity: CID 1128953.
Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/scsi_ioctl.c')
| -rw-r--r-- | block/scsi_ioctl.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c index 625e3e471d65..26487972ac54 100644 --- a/block/scsi_ioctl.c +++ b/block/scsi_ioctl.c @@ -323,12 +323,14 @@ static int sg_io(struct request_queue *q, struct gendisk *bd_disk, if (hdr->iovec_count) { size_t iov_data_len; - struct iovec *iov; + struct iovec *iov = NULL; ret = rw_copy_check_uvector(-1, hdr->dxferp, hdr->iovec_count, 0, NULL, &iov); - if (ret < 0) + if (ret < 0) { + kfree(iov); goto out; + } iov_data_len = ret; ret = 0; |