summaryrefslogtreecommitdiff
path: root/drivers/vhost
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2017-09-24 18:36:44 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2017-10-11 22:36:54 -0400
commit11d49e9d089ccec81be87c2386dfdd010d7f7f6e (patch)
treeb0f7adbe5d724edf295cfe639352273096ee9bda /drivers/vhost
parent09cf698a594276139b7dfafb232af3fe4fbc4438 (diff)
fix a page leak in vhost_scsi_iov_to_sgl() error recovery
we are advancing sg as we go, so the pages we need to drop in case of error are *before* the current sg. Cc: stable@vger.kernel.org Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'drivers/vhost')
-rw-r--r--drivers/vhost/scsi.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 046f6d280af5..e47c5bc3ddca 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -688,6 +688,7 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write,
struct scatterlist *sg, int sg_count)
{
size_t off = iter->iov_offset;
+ struct scatterlist *p = sg;
int i, ret;
for (i = 0; i < iter->nr_segs; i++) {
@@ -696,8 +697,8 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write,
ret = vhost_scsi_map_to_sgl(cmd, base, len, sg, write);
if (ret < 0) {
- for (i = 0; i < sg_count; i++) {
- struct page *page = sg_page(&sg[i]);
+ while (p < sg) {
+ struct page *page = sg_page(p++);
if (page)
put_page(page);
}