Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760289AbYBIMIw (ORCPT ); Sat, 9 Feb 2008 07:08:52 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755581AbYBIMGY (ORCPT ); Sat, 9 Feb 2008 07:06:24 -0500 Received: from sca-es-mail-2.Sun.COM ([192.18.43.133]:37331 "EHLO sca-es-mail-2.sun.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758656AbYBIMGV (ORCPT ); Sat, 9 Feb 2008 07:06:21 -0500 Date: Sat, 09 Feb 2008 04:13:52 -0800 From: Yinghai Lu Subject: [PATCH] scsi: ses fix for len and mem leaking when fail to add intf To: Andrew Morton , James Bottomley , Linux Kernel Mailing List Cc: linux-scsi@vger.kernel.org, linux-ide@vger.kernel.org, kristen.c.accardi@intel.com Message-id: <200802090413.53275.yinghai.lu@sun.com> Organization: Sun MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline User-Agent: KMail/1.9.6 (enterprise 20070904.708012) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4872 Lines: 172 [PATCH] scsi: ses fix for len and mem leaking when fail to add intf change to u32 before left shifting char also fix leaking with scomp leaking when failing. Signed-off-by: Yinghai Lu Index: linux-2.6/drivers/scsi/ses.c =================================================================== --- linux-2.6.orig/drivers/scsi/ses.c +++ linux-2.6/drivers/scsi/ses.c @@ -369,7 +369,7 @@ static void ses_match_to_enclosure(struc VPD_INQUIRY_SIZE, NULL, SES_TIMEOUT, SES_RETRIES)) goto free; - len = (buf[2] << 8) + buf[3]; + len = ((u32)buf[2] << 8) + buf[3]; desc = buf + 4; while (desc < buf + len) { enum scsi_protocol proto = desc[0] >> 4; @@ -420,7 +420,7 @@ static int ses_intf_add(struct class_dev if (!scsi_device_enclosure(sdev)) { /* not an enclosure, but might be in one */ - edev = enclosure_find(&sdev->host->shost_gendev); + edev = enclosure_find(&sdev->host->shost_gendev); if (edev) { ses_match_to_enclosure(edev, sdev); class_device_put(&edev->cdev); @@ -451,18 +451,18 @@ static int ses_intf_add(struct class_dev goto err_free; } - len = (hdr_buf[2] << 8) + hdr_buf[3] + 4; + len = ((u32)hdr_buf[2] << 8) + hdr_buf[3] + 4; buf = kzalloc(len, GFP_KERNEL); if (!buf) goto err_free; - ses_dev->page1 = buf; - ses_dev->page1_len = len; - result = ses_recv_diag(sdev, 1, buf, len); if (result) goto recv_failed; + ses_dev->page1 = buf; + ses_dev->page1_len = len; + types = buf[10]; len = buf[11]; @@ -474,11 +474,12 @@ static int ses_intf_add(struct class_dev components += type_ptr[1]; } + buf = NULL; result = ses_recv_diag(sdev, 2, hdr_buf, INIT_ALLOC_SIZE); if (result) goto recv_failed; - len = (hdr_buf[2] << 8) + hdr_buf[3] + 4; + len = ((u32)hdr_buf[2] << 8) + hdr_buf[3] + 4; buf = kzalloc(len, GFP_KERNEL); if (!buf) goto err_free; @@ -492,11 +493,12 @@ static int ses_intf_add(struct class_dev /* The additional information page --- allows us * to match up the devices */ + buf = NULL; result = ses_recv_diag(sdev, 10, hdr_buf, INIT_ALLOC_SIZE); if (result) goto no_page10; - len = (hdr_buf[2] << 8) + hdr_buf[3] + 4; + len = ((u32)hdr_buf[2] << 8) + hdr_buf[3] + 4; buf = kzalloc(len, GFP_KERNEL); if (!buf) goto err_free; @@ -506,16 +508,18 @@ static int ses_intf_add(struct class_dev goto recv_failed; ses_dev->page10 = buf; ses_dev->page10_len = len; + buf = NULL; no_page10: scomp = kmalloc(sizeof(struct ses_component) * components, GFP_KERNEL); if (!scomp) - goto err_free; + goto err_free; edev = enclosure_register(cdev->dev, sdev->sdev_gendev.bus_id, components, &ses_enclosure_callbacks); if (IS_ERR(edev)) { err = PTR_ERR(edev); + kfree(scomp); goto err_free; } @@ -524,24 +528,27 @@ static int ses_intf_add(struct class_dev edev->component[i].scratch = scomp++; /* Page 7 for the descriptors is optional */ - buf = NULL; result = ses_recv_diag(sdev, 7, hdr_buf, INIT_ALLOC_SIZE); if (result) goto simple_populate; - len = (hdr_buf[2] << 8) + hdr_buf[3] + 4; + len = ((u32)hdr_buf[2] << 8) + hdr_buf[3] + 4; /* add 1 for trailing '\0' we'll use */ buf = kzalloc(len + 1, GFP_KERNEL); - result = ses_recv_diag(sdev, 7, buf, len); - if (result) { + if (buf) + result = ses_recv_diag(sdev, 7, buf, len); + else + result = 7; + simple_populate: + if (result) { kfree(buf); buf = NULL; desc_ptr = NULL; addl_desc_ptr = NULL; } else { desc_ptr = buf + 8; - len = (desc_ptr[2] << 8) + desc_ptr[3]; + len = ((u32)desc_ptr[2] << 8) + desc_ptr[3]; /* skip past overall descriptor */ desc_ptr += len + 4; addl_desc_ptr = ses_dev->page10 + 8; @@ -554,7 +561,7 @@ static int ses_intf_add(struct class_dev struct enclosure_component *ecomp; if (desc_ptr) { - len = (desc_ptr[2] << 8) + desc_ptr[3]; + len = ((u32)desc_ptr[2] << 8) + desc_ptr[3]; desc_ptr += 4; /* Add trailing zero - pushes into * reserved space */ @@ -575,7 +582,7 @@ static int ses_intf_add(struct class_dev addl_desc_ptr); if (addl_desc_ptr) - addl_desc_ptr += addl_desc_ptr[1] + 2; + addl_desc_ptr += 2 + addl_desc_ptr[1]; } } } @@ -597,7 +604,6 @@ static int ses_intf_add(struct class_dev result); err = -ENODEV; err_free: - kfree(buf); kfree(ses_dev->page10); kfree(ses_dev->page2); kfree(ses_dev->page1); @@ -630,6 +636,7 @@ static void ses_intf_remove(struct class ses_dev = edev->scratch; edev->scratch = NULL; + kfree(ses_dev->page10); kfree(ses_dev->page1); kfree(ses_dev->page2); kfree(ses_dev); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/