Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Jianglei Nie <niejianglei2021@163.com>
To:     james.smart@broadcom.com, dick.kennedy@broadcom.com,
        jejb@linux.ibm.com, martin.petersen@oracle.com
Cc:     linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
        Jianglei Nie <niejianglei@gmail.com>,
        Jianglei Nie <niejianglei2021@163.com>
Subject: [PATCH] scsi: lpfc: Fix potential memory leak in lpfcdiag_sli3_loop_post_rxbufs()
Date:   Thu, 17 Nov 2022 10:36:19 +0800
Message-Id: <20221117023619.9565-1-niejianglei2021@163.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

From: Jianglei Nie <niejianglei@gmail.com>

lpfcdiag_sli3_loop_post_rxbufs() allocates a memory chunk from "rxbuffer"
with diag_cmd_data_alloc(). The "rxbuffer" should be freed when gets some
error. But when the function gets some error and jump to
"err_post_rxbufs_exit",The "rxbuffer" is not released, which will lead to
a memory leak.

We should free the "rxbuffer" with diag_cmd_data_free() in
"err_post_rxbufs_exit" when the "rxbuffer" is not NULL.

Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
Signed-off-by: Jianglei Nie <niejianglei@gmail.com>
---
 drivers/scsi/lpfc/lpfc_bsg.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
index 852b025e2fec..2693def758b7 100644
--- a/drivers/scsi/lpfc/lpfc_bsg.c
+++ b/drivers/scsi/lpfc/lpfc_bsg.c
@@ -2989,8 +2989,11 @@ static int lpfcdiag_sli3_loop_post_rxbufs(struct lpfc_hba *phba, uint16_t rxxri,
 err_post_rxbufs_exit:
 
 	if (rxbmp) {
-		if (rxbmp->virt)
+		if (rxbmp->virt) {
+			if (rxbuffer != NULL)
+				diag_cmd_data_free(phba, rxbuffer);
 			lpfc_mbuf_free(phba, rxbmp->virt, rxbmp->phys);
+		}
 		kfree(rxbmp);
 	}
 
-- 
2.25.1