SCSI: Fix protection scsi_data_buffer leak

commit b4c2554d40ceac130a8d062eaa8838ed22158c45 upstream.

We would leak a scsi_data_buffer if the free_list command was of the
protected variety.

Reported-by: Boaz Harrosh <bharrosh@panasas.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 2de5f3ad640b2da78eba5401454c8415f44841e4..69397bb964a4c05acbac504fd592a98f4140a11c 100644 (file)
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -241,10 +241,7 @@ scsi_host_alloc_command(struct Scsi_Host *shost, gfp_t gfp_mask)
  */
 struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
 {
-       struct scsi_cmnd *cmd;
-       unsigned char *buf;
-
-       cmd = scsi_host_alloc_command(shost, gfp_mask);
+       struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask);
 
        if (unlikely(!cmd)) {
                unsigned long flags;
@@ -258,9 +255,15 @@ struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
                spin_unlock_irqrestore(&shost->free_list_lock, flags);
 
                if (cmd) {
+                       void *buf, *prot;
+
                        buf = cmd->sense_buffer;
+                       prot = cmd->prot_sdb;
+
                        memset(cmd, 0, sizeof(*cmd));
+
                        cmd->sense_buffer = buf;
+                       cmd->prot_sdb = prot;
                }
        }