A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 11:54:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()

Browse source 
commit b81296591c567b12d3873b05a37b975707959b94 upstream.

Replace kmalloc() followed by copy_from_user() with memdup_user() to fix
a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and
the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using
memdup_user() avoids this by freeing the memory internally.

Since memdup_user() already allocates memory, use kzalloc() in the else
branch instead of manually zeroing 'buff[sg_used]' using memset(0).

Cc: stable@vger.kernel.org
Fixes: edd163687e ("[SCSI] hpsa: add driver for HP Smart Array controllers.")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Acked-by: Don Brace <don.brace@microchip.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Thorsten Blum 2025-09-19 11:26:37 +02:00 • committed by Greg Kroah-Hartman
commit 76307bb571
1 changed files with 12 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

21
drivers/scsi/hpsa.c
View file

@ -6508,18 +6508,21 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
while (left) {
sz = (left > ioc->malloc_size) ? ioc->malloc_size : left;
buff_size[sg_used] = sz;
buff[sg_used] = kmalloc(sz, GFP_KERNEL);
if (buff[sg_used] == NULL) {
status = -ENOMEM;
goto cleanup1;
}
if (ioc->Request.Type.Direction & XFER_WRITE) {
if (copy_from_user(buff[sg_used], data_ptr, sz)) {
status = -EFAULT;
buff[sg_used] = memdup_user(data_ptr, sz);
if (IS_ERR(buff[sg_used])) {
status = PTR_ERR(buff[sg_used]);
goto cleanup1;
}
} else
memset(buff[sg_used], 0, sz);
} else {
buff[sg_used] = kzalloc(sz, GFP_KERNEL);
if (!buff[sg_used]) {
status = -ENOMEM;
goto cleanup1;
}
}
left -= sz;
data_ptr += sz;
sg_used++;