diff mbox series

[5.10,014/104] nvmet: fix memory leak in nvmet_alloc_ctrl()

Message ID	20210524152333.299634693@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Wu Bo <wubo40@huawei.com>, Sagi Grimberg <sagi@grimberg.me>, Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>, Christoph Hellwig <hch@lst.de>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.10 014/104] nvmet: fix memory leak in nvmet_alloc_ctrl() Date: Mon, 24 May 2021 17:25:09 +0200 Message-Id: <20210524152333.299634693@linuxfoundation.org> In-Reply-To: <20210524152332.844251980@linuxfoundation.org> References: <20210524152332.844251980@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/104] openrisc: Fix a memory leak [5.10,003/104] tee: amdtee: unload TA only when its refcount becomes 0 [5.10,004/104] RDMA/siw: Properly check send and receive CQ pointers [5.10,005/104] RDMA/siw: Release xarray entry [5.10,006/104] RDMA/core: Prevent divide-by-zero error triggered by the user [5.10,007/104] RDMA/rxe: Clear all QP fields if creation failed [5.10,008/104] scsi: ufs: core: Increase the usable queue depth [5.10,009/104] scsi: qedf: Add pointer checks in qedf_update_link_speed() [5.10,010/104] scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() [5.10,011/104] RDMA/mlx5: Recover from fatal event in dual port mode [5.10,012/104] RDMA/core: Dont access cm_id after its destruction [5.10,013/104] nvmet: remove unused ctrl->cqs [5.10,014/104] nvmet: fix memory leak in nvmet_alloc_ctrl() [5.10,015/104] nvme-loop: fix memory leak in nvme_loop_create_ctrl() [5.10,016/104] nvme-tcp: rerun io_work if req_list is not empty [5.10,017/104] nvme-fc: clear q_live at beginning of association teardown [5.10,018/104] platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue [5.10,019/104] platform/x86: intel_int0002_vgpio: Only call enable_irq_wake() when using s2idle [5.10,020/104] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios [5.10,021/104] RDMA/mlx5: Fix query DCT via DEVX [5.10,022/104] RDMA/uverbs: Fix a NULL vs IS_ERR() bug [5.10,023/104] tools/testing/selftests/exec: fix link error [5.10,024/104] powerpc/pseries: Fix hcall tracing recursion in pv queued spinlocks [5.10,025/104] ptrace: make ptrace() fail if the tracee changed its pid unexpectedly [5.10,026/104] nvmet: seset ns->file when open fails [5.10,027/104] perf/x86: Avoid touching LBR_TOS MSR for Arch LBR [5.10,028/104] locking/lockdep: Correct calling tracepoints [5.10,029/104] locking/mutex: clear MUTEX_FLAGS if wait_list is empty due to signal [5.10,030/104] powerpc: Fix early setup to make early_ioremap() work [5.10,031/104] btrfs: avoid RCU stalls while running delayed iputs [5.10,032/104] cifs: fix memory leak in smb2_copychunk_range [5.10,033/104] misc: eeprom: at24: check suspend status before disable regulator [5.10,034/104] ALSA: dice: fix stream format for TC Electronic Konnekt Live at high sampling tran... [5.10,035/104] ALSA: intel8x0: Dont update period unless prepared [5.10,036/104] ALSA: firewire-lib: fix amdtp_packet tracepoints event for packet_index field [5.10,037/104] ALSA: line6: Fix racy initialization of LINE6 MIDI [5.10,038/104] ALSA: dice: fix stream format at middle sampling rate for Alesis iO 26 [5.10,039/104] ALSA: firewire-lib: fix calculation for size of IR context payload [5.10,040/104] ALSA: usb-audio: Validate MS endpoint descriptors [5.10,041/104] ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro [5.10,042/104] ALSA: hda: fixup headset for ASUS GU502 laptop [5.10,043/104] Revert "ALSA: sb8: add a check for request_region" [5.10,044/104] ALSA: firewire-lib: fix check for the size of isochronous packet payload [5.10,045/104] ALSA: hda/realtek: reset eapd coeff to default value for alc287 [5.10,046/104] ALSA: hda/realtek: Add some CLOVE SSIDs of ALC293 [5.10,047/104] ALSA: hda/realtek: Fix silent headphone output on ASUS UX430UA [5.10,048/104] ALSA: hda/realtek: Add fixup for HP OMEN laptop [5.10,049/104] ALSA: hda/realtek: Add fixup for HP Spectre x360 15-df0xxx [5.10,050/104] uio_hv_generic: Fix a memory leak in error handling paths [5.10,051/104] Revert "rapidio: fix a NULL pointer dereference when create_workqueue() fails" [5.10,052/104] rapidio: handle create_workqueue() failure [5.10,053/104] Revert "serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference" [5.10,054/104] nvme-tcp: fix possible use-after-completion [5.10,055/104] x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch [5.10,056/104] x86/sev-es: Invalidate the GHCB after completing VMGEXIT [5.10,057/104] x86/sev-es: Dont return NULL from sev_es_get_ghcb() [5.10,058/104] x86/sev-es: Use __put_user()/__get_user() for data accesses [5.10,059/104] x86/sev-es: Forward page-faults which happen during emulation [5.10,060/104] drm/amdgpu: Fix GPU TLB update error when PAGE_SIZE > AMDGPU_PAGE_SIZE [5.10,061/104] drm/amdgpu: disable 3DCGCG on picasso/raven1 to avoid compute hang [5.10,062/104] drm/amdgpu: update gc golden setting for Navi12 [5.10,063/104] drm/amdgpu: update sdma golden setting for Navi12 [5.10,064/104] powerpc/64s/syscall: Use pt_regs.trap to distinguish syscall ABI difference betwee... [5.10,065/104] powerpc/64s/syscall: Fix ptrace syscall info with scv syscalls [5.10,066/104] mmc: sdhci-pci-gli: increase 1.8V regulator wait [5.10,067/104] xen-pciback: redo VF placement in the virtual topology [5.10,068/104] xen-pciback: reconfigure also from backend watch handler [5.10,069/104] ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry [5.10,070/104] dm snapshot: fix a crash when an origin has no snapshots [5.10,071/104] dm snapshot: fix crash with transient storage and zero chunk size [5.10,072/104] kcsan: Fix debugfs initcall return type [5.10,073/104] Revert "video: hgafb: fix potential NULL pointer dereference" [5.10,074/104] Revert "net: stmicro: fix a missing check of clk_prepare" [5.10,075/104] Revert "leds: lp5523: fix a missing check of return value of lp55xx_read" [5.10,076/104] Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe" [5.10,077/104] Revert "video: imsttfb: fix potential NULL pointer dereferences" [5.10,078/104] Revert "ecryptfs: replace BUG_ON with error handling code" [5.10,079/104] Revert "scsi: ufs: fix a missing check of devm_reset_control_get" [5.10,080/104] Revert "gdrom: fix a memory leak bug" [5.10,081/104] cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom [5.10,082/104] cdrom: gdrom: initialize global variable at init time [5.10,083/104] Revert "media: rcar_drif: fix a memory disclosure" [5.10,084/104] Revert "rtlwifi: fix a potential NULL pointer dereference" [5.10,085/104] Revert "qlcnic: Avoid potential NULL pointer dereference" [5.10,086/104] Revert "niu: fix missing checks of niu_pci_eeprom_read" [5.10,087/104] ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read() [5.10,088/104] net: stmicro: handle clk_prepare() failure during init [5.10,089/104] scsi: ufs: handle cleanup correctly on devm_reset_control_get error [5.10,090/104] net: rtlwifi: properly check for alloc_workqueue() failure [5.10,091/104] ics932s401: fix broken handling of errors when word reading fails [5.10,092/104] leds: lp5523: check return value of lp5xx_read and jump to cleanup code [5.10,093/104] qlcnic: Add null check after calling netdev_alloc_skb [5.10,094/104] video: hgafb: fix potential NULL pointer dereference [5.10,095/104] vgacon: Record video mode changes with VT_RESIZEX [5.10,096/104] vt_ioctl: Revert VT_RESIZEX parameter handling removal [5.10,097/104] vt: Fix character height handling with VT_RESIZEX [5.10,098/104] tty: vt: always invoke vc->vc_sw->con_resize callback [5.10,099/104] drm/i915/gt: Disable HiZ Raw Stall Optimization on broken gen7 [5.10,100/104] openrisc: mm/init.c: remove unused memblock_region variable in map_ram() [5.10,101/104] x86/Xen: swap NX determination and GDT setup on BSP [5.10,102/104] nvme-multipath: fix double initialization of ANA state [5.10,103/104] rtc: pcf85063: fallback to parent of_node [5.10,104/104] x86/boot/compressed/64: Check SEV encryption in the 32-bit boot-path

Commit Message

Greg Kroah-Hartman May 24, 2021, 3:25 p.m. UTC

From: Wu Bo <wubo40@huawei.com>

[ Upstream commit fec356a61aa3d3a66416b4321f1279e09e0f256f ]

When creating ctrl in nvmet_alloc_ctrl(), if the cntlid_min is larger
than cntlid_max of the subsystem, and jumps to the
"out_free_changed_ns_list" label, but the ctrl->sqs lack of be freed.
Fix this by jumping to the "out_free_sqs" label.

Fixes: 94a39d61f80f ("nvmet: make ctrl-id configurable")
Signed-off-by: Wu Bo <wubo40@huawei.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 870d06cfd815..46e4f7ea34c8 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -1360,7 +1360,7 @@  u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
 		goto out_free_changed_ns_list;
 
 	if (subsys->cntlid_min > subsys->cntlid_max)
-		goto out_free_changed_ns_list;
+		goto out_free_sqs;
 
 	ret = ida_simple_get(&cntlid_ida,
 			     subsys->cntlid_min, subsys->cntlid_max,