Message ID | 20250318094344.91776-1-linmq006@gmail.com (mailing list archive) |
---|---|
State | New |
Headers | show |
Series | scsi: iscsi: Fix missing scsi_host_put in error path | expand |
On 3/18/25 4:43 AM, linmq006@gmail.com wrote: > From: Miaoqian Lin <linmq006@gmail.com> > > Add goto to ensure scsi_host_put is called in all error paths of > iscsi_set_host_param function. This fixes a potential memory leak when > strlen check fails. > > Fixes: ce51c8170084 ("scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()") > Signed-off-by: Miaoqian Lin <linmq006@gmail.com> > --- > drivers/scsi/scsi_transport_iscsi.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c > index 9c347c64c315..0b8c91bf793f 100644 > --- a/drivers/scsi/scsi_transport_iscsi.c > +++ b/drivers/scsi/scsi_transport_iscsi.c > @@ -3182,11 +3182,14 @@ iscsi_set_host_param(struct iscsi_transport *transport, > } > > /* see similar check in iscsi_if_set_param() */ > - if (strlen(data) > ev->u.set_host_param.len) > - return -EINVAL; > + if (strlen(data) > ev->u.set_host_param.len) { > + err = -EINVAL; > + goto out; > + } > > err = transport->set_host_param(shost, ev->u.set_host_param.param, > data, ev->u.set_host_param.len); > +out: > scsi_host_put(shost); > return err; > } Reviewed-by: Mike Christie <michael.christie@oracle.com>
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c index 9c347c64c315..0b8c91bf793f 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -3182,11 +3182,14 @@ iscsi_set_host_param(struct iscsi_transport *transport, } /* see similar check in iscsi_if_set_param() */ - if (strlen(data) > ev->u.set_host_param.len) - return -EINVAL; + if (strlen(data) > ev->u.set_host_param.len) { + err = -EINVAL; + goto out; + } err = transport->set_host_param(shost, ev->u.set_host_param.param, data, ev->u.set_host_param.len); +out: scsi_host_put(shost); return err; }