svn commit: r275673 - stable/10/sys/cam/ctl

[Alexander Motin]

Author: mav
Date: Wed Dec 10 08:52:47 2014
New Revision: 275673
URL: https://svnweb.freebsd.org/changeset/base/275673

Log:
  MFC r275446: Plug memory leaks on UNMAP and XCOPY with invalid parameters.

Modified:
  stable/10/sys/cam/ctl/ctl.c
  stable/10/sys/cam/ctl/ctl_tpc.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/cam/ctl/ctl.c
==============================================================================
--- stable/10/sys/cam/ctl/ctl.c	Wed Dec 10 08:36:40 2014	(r275672)
+++ stable/10/sys/cam/ctl/ctl.c	Wed Dec 10 08:52:47 2014	(r275673)
@@ -6166,8 +6166,7 @@ ctl_unmap(struct ctl_scsiio *ctsio)
 				      /*field*/ 0,
 				      /*bit_valid*/ 0,
 				      /*bit*/ 0);
-		ctl_done((union ctl_io *)ctsio);
-		return (CTL_RETVAL_COMPLETE);
+		goto done;
 	}
 	len = scsi_2btoul(hdr->desc_length);
 	buf = (struct scsi_unmap_desc *)(hdr + 1);
@@ -6194,8 +6193,7 @@ ctl_unmap(struct ctl_scsiio *ctsio)
 	len = (uint8_t *)endnz - (uint8_t *)buf;
 	if (len == 0) {
 		ctl_set_success(ctsio);
-		ctl_done((union ctl_io *)ctsio);
-		return (CTL_RETVAL_COMPLETE);
+		goto done;
 	}
 
 	mtx_lock(&lun->lun_lock);
@@ -6209,6 +6207,14 @@ ctl_unmap(struct ctl_scsiio *ctsio)
 
 	retval = lun->backend->config_write((union ctl_io *)ctsio);
 	return (retval);
+
+done:
+	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+	}
+	ctl_done((union ctl_io *)ctsio);
+	return (CTL_RETVAL_COMPLETE);
 }
 
 /*

Modified: stable/10/sys/cam/ctl/ctl_tpc.c
==============================================================================
--- stable/10/sys/cam/ctl/ctl_tpc.c	Wed Dec 10 08:36:40 2014	(r275672)
+++ stable/10/sys/cam/ctl/ctl_tpc.c	Wed Dec 10 08:52:47 2014	(r275673)
@@ -1678,6 +1678,10 @@ ctl_extended_copy_lid1(struct ctl_scsiio
 	return (CTL_RETVAL_COMPLETE);
 
 done:
+	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+	}
 	ctl_done((union ctl_io *)ctsio);
 	return (CTL_RETVAL_COMPLETE);
 }
@@ -1801,6 +1805,10 @@ ctl_extended_copy_lid4(struct ctl_scsiio
 	return (CTL_RETVAL_COMPLETE);
 
 done:
+	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
+		free(ctsio->kern_data_ptr, M_CTL);
+		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+	}
 	ctl_done((union ctl_io *)ctsio);
 	return (CTL_RETVAL_COMPLETE);
 }
@@ -1978,8 +1986,10 @@ ctl_populate_token(struct ctl_scsiio *ct
 	return (CTL_RETVAL_COMPLETE);
 
 done:
-	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED)
+	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
 		free(ctsio->kern_data_ptr, M_CTL);
+		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+	}
 	ctl_done((union ctl_io *)ctsio);
 	return (CTL_RETVAL_COMPLETE);
 }
@@ -2103,8 +2113,10 @@ ctl_write_using_token(struct ctl_scsiio 
 	return (CTL_RETVAL_COMPLETE);
 
 done:
-	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED)
+	if (ctsio->io_hdr.flags & CTL_FLAG_ALLOCATED) {
 		free(ctsio->kern_data_ptr, M_CTL);
+		ctsio->io_hdr.flags &= ~CTL_FLAG_ALLOCATED;
+	}
 	ctl_done((union ctl_io *)ctsio);
 	return (CTL_RETVAL_COMPLETE);
 }