From: Julian Wiedmann Date: Tue, 9 Mar 2021 17:52:18 +0100 Subject: s390/qeth: fix memory leak after failed TX Buffer allocation Git-commit: e7a36d27f6b9f389e41d8189a8a08919c6835732 Patch-mainline: v5.12-rc3 References: git-fixes When qeth_alloc_qdio_queues() fails to allocate one of the buffers that back an Output Queue, the 'out_freeoutqbufs' path will free all previously allocated buffers for this queue. But it misses to free the half-finished queue struct itself. Move the buffer allocation into qeth_alloc_output_queue(), and deal with such errors internally. Fixes: 0da9581ddb0f ("qeth: exploit asynchronous delivery of storage blocks") Signed-off-by: Julian Wiedmann Reviewed-by: Alexandra Winter Signed-off-by: David S. Miller [ ptesarik: qeth_alloc_output_queue() was called qeth_alloc_qdio_out_buf() and qeth_alloc_qdio_queues() was called qeth_alloc_qdio_buffers() before upstream commit 41c47da3b6e5b8e03d69c3391de0b22f31c3fea1. ] Acked-by: Petr Tesarik --- drivers/s390/net/qeth_core_main.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) --- a/drivers/s390/net/qeth_core_main.c +++ b/drivers/s390/net/qeth_core_main.c @@ -2447,20 +2447,33 @@ static void qeth_free_output_queue(struc static struct qeth_qdio_out_q *qeth_alloc_qdio_out_buf(void) { struct qeth_qdio_out_q *q = kzalloc(sizeof(*q), GFP_KERNEL); + unsigned int i; if (!q) return NULL; - if (qdio_alloc_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q)) { - kfree(q); - return NULL; + if (qdio_alloc_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q)) + goto err_qdio_bufs; + + for (i = 0; i < QDIO_MAX_BUFFERS_PER_Q; i++) { + if (qeth_init_qdio_out_buf(q, i)) + goto err_out_bufs; } + return q; + +err_out_bufs: + while (i > 0) + kmem_cache_free(qeth_qdio_outbuf_cache, q->bufs[--i]); + qdio_free_buffers(q->qdio_bufs, QDIO_MAX_BUFFERS_PER_Q); +err_qdio_bufs: + kfree(q); + return NULL; } static int qeth_alloc_qdio_buffers(struct qeth_card *card) { - int i, j; + unsigned int i; QETH_DBF_TEXT(SETUP, 2, "allcqdbf"); @@ -2490,12 +2503,6 @@ static int qeth_alloc_qdio_buffers(struc QETH_DBF_TEXT_(SETUP, 2, "outq %i", i); QETH_DBF_HEX(SETUP, 2, &card->qdio.out_qs[i], sizeof(void *)); card->qdio.out_qs[i]->queue_no = i; - /* give outbound qeth_qdio_buffers their qdio_buffers */ - for (j = 0; j < QDIO_MAX_BUFFERS_PER_Q; ++j) { - WARN_ON(card->qdio.out_qs[i]->bufs[j] != NULL); - if (qeth_init_qdio_out_buf(card->qdio.out_qs[i], j)) - goto out_freeoutqbufs; - } } /* completion */ @@ -2504,13 +2511,6 @@ static int qeth_alloc_qdio_buffers(struc return 0; -out_freeoutqbufs: - while (j > 0) { - --j; - kmem_cache_free(qeth_qdio_outbuf_cache, - card->qdio.out_qs[i]->bufs[j]); - card->qdio.out_qs[i]->bufs[j] = NULL; - } out_freeoutq: while (i > 0) qeth_free_output_queue(card->qdio.out_qs[--i]);