[xilinx-xlnx:xlnx_rebase_v5.15_LTS 337/1039] drivers/usb/storage/uas.c:564 uas_workaround() warn: possible memory leak of 'temp_request'
Dan Carpenter
dan.carpenter at oracle.com
Tue Mar 29 02:34:30 PDT 2022
tree: https://github.com/Xilinx/linux-xlnx xlnx_rebase_v5.15_LTS
head: ea33365bd1a8cf667a122498e8f551df05609f92
commit: 6e36c8e67532397180bc05d39599d0d16a82269c [337/1039] usb: uas: Add workaround for DATA IN urb's returned with status -EAGAIN
config: nios2-randconfig-m031-20220328 (https://download.01.org/0day-ci/archive/20220329/202203291444.T1BtW3fe-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 11.2.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp at intel.com>
Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
smatch warnings:
drivers/usb/storage/uas.c:564 uas_workaround() warn: possible memory leak of 'temp_request'
vim +/temp_request +564 drivers/usb/storage/uas.c
6e36c8e6753239 Piyush Mehta 2022-01-26 459 static int uas_workaround(struct urb *urb)
6e36c8e6753239 Piyush Mehta 2022-01-26 460 {
6e36c8e6753239 Piyush Mehta 2022-01-26 461 struct scsi_cmnd *cmnd = urb->context;
6e36c8e6753239 Piyush Mehta 2022-01-26 462 struct scsi_device *sdev = cmnd->device;
6e36c8e6753239 Piyush Mehta 2022-01-26 463 struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
6e36c8e6753239 Piyush Mehta 2022-01-26 464 struct scsi_cmnd *temp_cmnd;
6e36c8e6753239 Piyush Mehta 2022-01-26 465 struct uas_cmd_info *temp_cmdinfo;
6e36c8e6753239 Piyush Mehta 2022-01-26 466 struct urb *sense_urb, *data_urb, *cmnd_urb;
6e36c8e6753239 Piyush Mehta 2022-01-26 467 struct request *temp_request;
6e36c8e6753239 Piyush Mehta 2022-01-26 468 unsigned int idx;
6e36c8e6753239 Piyush Mehta 2022-01-26 469 int err;
6e36c8e6753239 Piyush Mehta 2022-01-26 470 char inquiry[16] = { 0x12, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0,
6e36c8e6753239 Piyush Mehta 2022-01-26 471 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 };
6e36c8e6753239 Piyush Mehta 2022-01-26 472
6e36c8e6753239 Piyush Mehta 2022-01-26 473
6e36c8e6753239 Piyush Mehta 2022-01-26 474 /* Find a free uas-tag */
6e36c8e6753239 Piyush Mehta 2022-01-26 475 for (idx = 0; idx < devinfo->qdepth; idx++) {
6e36c8e6753239 Piyush Mehta 2022-01-26 476 if (!devinfo->cmnd[idx])
6e36c8e6753239 Piyush Mehta 2022-01-26 477 break;
6e36c8e6753239 Piyush Mehta 2022-01-26 478 }
6e36c8e6753239 Piyush Mehta 2022-01-26 479
6e36c8e6753239 Piyush Mehta 2022-01-26 480 if (idx == devinfo->qdepth) {
6e36c8e6753239 Piyush Mehta 2022-01-26 481 shost_printk(KERN_INFO, sdev->host,
6e36c8e6753239 Piyush Mehta 2022-01-26 482 "%s: Failed to find free tag\n", __func__);
6e36c8e6753239 Piyush Mehta 2022-01-26 483 err = -EINVAL;
6e36c8e6753239 Piyush Mehta 2022-01-26 484 goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26 485 }
6e36c8e6753239 Piyush Mehta 2022-01-26 486
6e36c8e6753239 Piyush Mehta 2022-01-26 487 /* Create a scsi_cmnd and send dummy inquiry data on the next
6e36c8e6753239 Piyush Mehta 2022-01-26 488 * available tag
6e36c8e6753239 Piyush Mehta 2022-01-26 489 */
6e36c8e6753239 Piyush Mehta 2022-01-26 490 temp_cmnd = kzalloc(sizeof(struct scsi_cmnd), GFP_ATOMIC);
6e36c8e6753239 Piyush Mehta 2022-01-26 491 if (!temp_cmnd) {
6e36c8e6753239 Piyush Mehta 2022-01-26 492 shost_printk(KERN_INFO, sdev->host,
6e36c8e6753239 Piyush Mehta 2022-01-26 493 "%s: Failed to allocate memory for scsi_cmnd\n",
6e36c8e6753239 Piyush Mehta 2022-01-26 494 __func__);
6e36c8e6753239 Piyush Mehta 2022-01-26 495 err = -ENOMEM;
6e36c8e6753239 Piyush Mehta 2022-01-26 496 goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26 497 }
6e36c8e6753239 Piyush Mehta 2022-01-26 498
6e36c8e6753239 Piyush Mehta 2022-01-26 499 temp_request = kzalloc(sizeof(struct request), GFP_ATOMIC);
6e36c8e6753239 Piyush Mehta 2022-01-26 500 if (!temp_cmnd) {
6e36c8e6753239 Piyush Mehta 2022-01-26 501 shost_printk(KERN_INFO, sdev->host,
6e36c8e6753239 Piyush Mehta 2022-01-26 502 "%s: Failed to allocate memory for request\n",
6e36c8e6753239 Piyush Mehta 2022-01-26 503 __func__);
6e36c8e6753239 Piyush Mehta 2022-01-26 504 err = -ENOMEM;
6e36c8e6753239 Piyush Mehta 2022-01-26 505 goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26 506 }
6e36c8e6753239 Piyush Mehta 2022-01-26 507
6e36c8e6753239 Piyush Mehta 2022-01-26 508 temp_cmnd->device = cmnd->device;
6e36c8e6753239 Piyush Mehta 2022-01-26 509 temp_cmnd->cmnd = inquiry;
6e36c8e6753239 Piyush Mehta 2022-01-26 510 temp_cmnd->cmd_len = 16;
6e36c8e6753239 Piyush Mehta 2022-01-26 511 temp_cmnd->sdb.length = 0x10;
6e36c8e6753239 Piyush Mehta 2022-01-26 512 temp_cmnd->scsi_done = dummy_scsi_done;
6e36c8e6753239 Piyush Mehta 2022-01-26 513 temp_request->tag = idx;
6e36c8e6753239 Piyush Mehta 2022-01-26 514
6e36c8e6753239 Piyush Mehta 2022-01-26 515 temp_cmdinfo = (struct uas_cmd_info *)&temp_cmnd->SCp;
6e36c8e6753239 Piyush Mehta 2022-01-26 516 memset(temp_cmdinfo, 0, sizeof(struct uas_cmd_info));
6e36c8e6753239 Piyush Mehta 2022-01-26 517
6e36c8e6753239 Piyush Mehta 2022-01-26 518 temp_cmdinfo->uas_tag = idx + 1;
6e36c8e6753239 Piyush Mehta 2022-01-26 519 devinfo->cmnd[idx] = temp_cmnd;
6e36c8e6753239 Piyush Mehta 2022-01-26 520
6e36c8e6753239 Piyush Mehta 2022-01-26 521 /* Submit previously stopped URB first */
6e36c8e6753239 Piyush Mehta 2022-01-26 522 err = usb_submit_urb(urb, GFP_ATOMIC);
6e36c8e6753239 Piyush Mehta 2022-01-26 523 if (err) {
6e36c8e6753239 Piyush Mehta 2022-01-26 524 shost_printk(KERN_INFO, sdev->host,
6e36c8e6753239 Piyush Mehta 2022-01-26 525 "%s: submit err %d\n", __func__, err);
6e36c8e6753239 Piyush Mehta 2022-01-26 526 kfree(temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26 527 kfree(temp_request);
6e36c8e6753239 Piyush Mehta 2022-01-26 528 goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26 529 }
6e36c8e6753239 Piyush Mehta 2022-01-26 530 usb_anchor_urb(urb, &devinfo->data_urbs);
6e36c8e6753239 Piyush Mehta 2022-01-26 531
6e36c8e6753239 Piyush Mehta 2022-01-26 532 /* Allocate and submit SENSE urb for next available tag */
6e36c8e6753239 Piyush Mehta 2022-01-26 533 sense_urb = uas_workaround_sense(devinfo, GFP_ATOMIC, temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26 534 if (!sense_urb) {
6e36c8e6753239 Piyush Mehta 2022-01-26 535 kfree(temp_request);
6e36c8e6753239 Piyush Mehta 2022-01-26 536 kfree(temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26 537 goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26 538 }
6e36c8e6753239 Piyush Mehta 2022-01-26 539
6e36c8e6753239 Piyush Mehta 2022-01-26 540 /* Allocate and submit DATA IN urb for next available tag */
6e36c8e6753239 Piyush Mehta 2022-01-26 541 data_urb = uas_workaround_data(devinfo, GFP_ATOMIC, temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26 542 if (!data_urb) {
6e36c8e6753239 Piyush Mehta 2022-01-26 543 /* Kill previously allocated sense urb */
6e36c8e6753239 Piyush Mehta 2022-01-26 544 sense_urb->context = NULL;
6e36c8e6753239 Piyush Mehta 2022-01-26 545 usb_kill_urb(sense_urb);
6e36c8e6753239 Piyush Mehta 2022-01-26 546 usb_put_urb(sense_urb);
6e36c8e6753239 Piyush Mehta 2022-01-26 547 kfree(temp_request);
6e36c8e6753239 Piyush Mehta 2022-01-26 548 kfree(temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26 549 goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26 550 }
6e36c8e6753239 Piyush Mehta 2022-01-26 551
6e36c8e6753239 Piyush Mehta 2022-01-26 552 /* Allocate and submit CMND urb with dummy inquiry data */
6e36c8e6753239 Piyush Mehta 2022-01-26 553 cmnd_urb = uas_workaround_cmnd(devinfo, GFP_ATOMIC, temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26 554 if (!cmnd_urb) {
6e36c8e6753239 Piyush Mehta 2022-01-26 555 /* Kill previously allocated data urb */
6e36c8e6753239 Piyush Mehta 2022-01-26 556 data_urb->context = NULL;
6e36c8e6753239 Piyush Mehta 2022-01-26 557 usb_kill_urb(data_urb);
6e36c8e6753239 Piyush Mehta 2022-01-26 558 usb_put_urb(data_urb);
6e36c8e6753239 Piyush Mehta 2022-01-26 559 kfree(temp_request);
6e36c8e6753239 Piyush Mehta 2022-01-26 560 kfree(temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26 561 }
6e36c8e6753239 Piyush Mehta 2022-01-26 562
6e36c8e6753239 Piyush Mehta 2022-01-26 563 free:
6e36c8e6753239 Piyush Mehta 2022-01-26 @564 return err;
temp_request is leaked on the success path. temp_request is not used
anywhere, just delete it.
Use free the last thing style for cleanup.
https://lore.kernel.org/all/20210831084735.GL12231@kadam/
6e36c8e6753239 Piyush Mehta 2022-01-26 565 }
--
0-DAY CI Kernel Test Service
https://01.org/lkp
More information about the linux-arm-kernel
mailing list