[PATCH 1/4] scsi: pm8001: fix a memory leak in nvmd_resp

[PATCH 1/4] scsi: pm8001: fix a memory leak in nvmd_resp

[Tomas Henzl]

Instead of copying information to fw_control_context free it.

The task is forgotten thus also the reference to fw_control_context
and the completion thread takes the info from virt_ptr again.

Signed-off-by: Tomas Henzl <thenzl@redhat.com>
---
 drivers/scsi/pm8001/pm8001_hwi.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index cacb429..dc70791 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -3129,7 +3129,6 @@ void pm8001_mpi_set_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
 void
 pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
 {
-	struct fw_control_ex	*fw_control_context;
 	struct get_nvm_data_resp *pPayload =
 		(struct get_nvm_data_resp *)(piomb + 4);
 	u32 tag = le32_to_cpu(pPayload->tag);
@@ -3138,7 +3137,6 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
 	u32 ir_tds_bn_dps_das_nvm =
 		le32_to_cpu(pPayload->ir_tda_bn_dps_das_nvm);
 	void *virt_addr = pm8001_ha->memoryMap.region[NVMD].virt_ptr;
-	fw_control_context = ccb->fw_control_context;
 
 	PM8001_MSG_DBG(pm8001_ha, pm8001_printk("Get nvm data complete!\n"));
 	if ((dlen_status & NVMD_STAT) != 0) {
@@ -3179,13 +3177,11 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
 			pm8001_printk("Get NVMD success, IR=0, dataLen=%d\n",
 			(dlen_status & NVMD_LEN) >> 24));
 	}
-	memcpy(fw_control_context->usrAddr,
-		pm8001_ha->memoryMap.region[NVMD].virt_ptr,
-		fw_control_context->len);
-	complete(pm8001_ha->nvmd_completion);
+	kfree(ccb->fw_control_context);
 	ccb->task = NULL;
 	ccb->ccb_tag = 0xFFFFFFFF;
 	pm8001_tag_free(pm8001_ha, tag);
+	complete(pm8001_ha->nvmd_completion);
 }
 
 int pm8001_mpi_local_phy_ctl(struct pm8001_hba_info *pm8001_ha, void *piomb)
-- 
1.8.3.1

RE: [PATCH 1/4] scsi: pm8001: fix a memory leak in nvmd_resp

[Suresh Thiagarajan]

On Mon, Jul 7, 2014 at 8:49 PM, Tomas Henzl <thenzl@redhat.com> wrote:
> Instead of copying information to fw_control_context free it.
>
> The task is forgotten thus also the reference to fw_control_context
> and the completion thread takes the info from virt_ptr again.

Looks good. Thanks Tomas.
Acked-by: Suresh Thiagarajan<Suresh.Thiagarajan@pmcs.com>

>
> Signed-off-by: Tomas Henzl <thenzl@redhat.com>
> ---
>  drivers/scsi/pm8001/pm8001_hwi.c | 8 ++------
>  1 file changed, 2 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
> index cacb429..dc70791 100644
> --- a/drivers/scsi/pm8001/pm8001_hwi.c
> +++ b/drivers/scsi/pm8001/pm8001_hwi.c
> @@ -3129,7 +3129,6 @@ void pm8001_mpi_set_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
>  void
>  pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
>  {
> -       struct fw_control_ex    *fw_control_context;
>         struct get_nvm_data_resp *pPayload =
>                 (struct get_nvm_data_resp *)(piomb + 4);
>         u32 tag = le32_to_cpu(pPayload->tag);
> @@ -3138,7 +3137,6 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
>         u32 ir_tds_bn_dps_das_nvm =
>                 le32_to_cpu(pPayload->ir_tda_bn_dps_das_nvm);
>         void *virt_addr = pm8001_ha->memoryMap.region[NVMD].virt_ptr;
> -       fw_control_context = ccb->fw_control_context;
>
>         PM8001_MSG_DBG(pm8001_ha, pm8001_printk("Get nvm data complete!\n"));
>         if ((dlen_status & NVMD_STAT) != 0) {
> @@ -3179,13 +3177,11 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
>                         pm8001_printk("Get NVMD success, IR=0, dataLen=%d\n",
>                         (dlen_status & NVMD_LEN) >> 24));
>         }
> -       memcpy(fw_control_context->usrAddr,
> -               pm8001_ha->memoryMap.region[NVMD].virt_ptr,
> -               fw_control_context->len);
> -       complete(pm8001_ha->nvmd_completion);
> +       kfree(ccb->fw_control_context);
>         ccb->task = NULL;
>         ccb->ccb_tag = 0xFFFFFFFF;
>         pm8001_tag_free(pm8001_ha, tag);
> +       complete(pm8001_ha->nvmd_completion);
>  }
>
>  int pm8001_mpi_local_phy_ctl(struct pm8001_hba_info *pm8001_ha, void *piomb)
> --
> 1.8.3.1
>