Commit de959094 authored by Naohiro Aota's avatar Naohiro Aota Committed by Martin K. Petersen
Browse files

scsi: target: pscsi: Fix bio_put() for error case 



As of commit 066ff571 ("block: turn bio_kmalloc into a simple kmalloc
wrapper"), a bio allocated by bio_kmalloc() must be freed by bio_uninit()
and kfree(). That is not done properly for the error case, hitting WARN and
NULL pointer dereference in bio_free().

Fixes: 066ff571 ("block: turn bio_kmalloc into a simple kmalloc wrapper")
CC: stable@vger.kernel.org # 6.1+
Signed-off-by: default avatarNaohiro Aota <naohiro.aota@wdc.com>
Link: https://lore.kernel.org/r/20240214144356.101814-1-naohiro.aota@wdc.com


Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent b5fc07a5

drivers/target/target_core_pscsi.c

+6 −3
Original line number Diff line number Diff line
@@ -907,12 +907,15 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, 


	return 0;

fail:

	if (bio)

		bio_put(bio);

	if (bio) {

		bio_uninit(bio);

		kfree(bio);

	}

	while (req->bio) {

		bio = req->bio;

		req->bio = bio->bi_next;

		bio_put(bio);

		bio_uninit(bio);

		kfree(bio);

	}

	req->biotail = NULL;

	return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;