From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B2103ACA4B; Sat, 17 Oct 2026 16:37:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792255058; cv=none; b=kMN9Zktn0tmhPqRUPqM9/sKI04w9bOLZhN1kPsiaVQfd/mXlwwIAtRsWqibK9ob7dKe3wsC6MomQ+n9F4tdlL3hadot+TbyAh6+UJ+y8hrTy47rmPkReU7IdrJLo7PnKGd0Amoarve5DgVUx8U6UjmYlmcBThg00sUBQBWJTzlY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792255058; c=relaxed/simple; bh=3d5hCesPPVvXfEg0dSVJ0HfWjr5eYaFCQs7YtqGOFTo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Q6dzLJnEgg69w+DEqp/1YsfDdlsnd2UFs6AB/4b8vUkp2SBFmb+34Hq+/4gQ4wPSitrzv/Q7zapueEh0FcQijryC52aX8+PPnYTvkry2KMtlWigMdgKeREGkMxNov662xXiR0X6PYeZEJcf7jYMV9tElvqHijTLxG/clYhpQejo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=VVJRzk+3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="VVJRzk+3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C83C11F000C4; Sat, 17 Oct 2026 16:37:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792255057; bh=Az3tGSqHgAglhOOuglPLPh92Xa/ZYziuDlU9IQaobp8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=VVJRzk+36RjZn3aOV4zbyAJ8IiUceAYicXGxV4ZOCumtRwzov+yazXicnHWTlBYvA WlzDVMJqmCDJfPoKLFySm9B/X5hJ8/OwXgvPT09uCRSz8Ju4UFxJ3X+50tp2nxuO6U cj10IZlDlX8ijkXGXKNICdFXMdr5LehCZXDE+vY4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Damien Le Moal , Yang Xiuwei , John Garry , "Martin K. Petersen (Oracle)" , Sasha Levin Subject: [PATCH 6.12 649/869] scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails Date: Sat, 17 Oct 2026 17:58:10 +0200 Message-ID: <20261017160053.648780559@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261017160036.979869304@linuxfoundation.org> References: <20261017160036.979869304@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yang Xiuwei [ Upstream commit bb31844d88b77138b67aa20c3600203baff40140 ] sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page. Call sd_uninit_command() on error, and clear RQF_SPECIAL_PAYLOAD after freeing the page. Fixes: 81d926e8b552 ("sd: split sd_setup_discard_cmnd") Reviewed-by: Damien Le Moal Signed-off-by: Yang Xiuwei Reviewed-by: John Garry Link: https://patch.msgid.link/20260707030333.22245-3-yangxiuwei@kylinos.cn Signed-off-by: Martin K. Petersen (Oracle) Signed-off-by: Sasha Levin --- drivers/scsi/sd.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-) --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -890,6 +890,17 @@ static unsigned char sd_setup_protect_cm return protect; } +static void sd_uninit_command(struct scsi_cmnd *cmd) +{ + struct request *rq = scsi_cmd_to_rq(cmd); + + if (!(rq->rq_flags & RQF_SPECIAL_PAYLOAD)) + return; + + mempool_free(rq->special_vec.bv_page, sd_page_pool); + rq->rq_flags &= ~RQF_SPECIAL_PAYLOAD; +} + static void *sd_set_special_bvec(struct request *rq, unsigned int data_len) { struct page *page; @@ -912,6 +923,7 @@ static blk_status_t sd_setup_unmap_cmnd( u32 nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq)); unsigned int data_len = 24; char *buf; + blk_status_t ret; buf = sd_set_special_bvec(rq, data_len); if (!buf) @@ -930,7 +942,10 @@ static blk_status_t sd_setup_unmap_cmnd( cmd->transfersize = data_len; rq->timeout = SD_TIMEOUT; - return scsi_alloc_sgtables(cmd); + ret = scsi_alloc_sgtables(cmd); + if (ret != BLK_STS_OK) + sd_uninit_command(cmd); + return ret; } static void sd_config_atomic(struct scsi_disk *sdkp, struct queue_limits *lim) @@ -1000,6 +1015,7 @@ static blk_status_t sd_setup_write_same1 u64 lba = sectors_to_logical(sdp, blk_rq_pos(rq)); u32 nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq)); u32 data_len = sdp->sector_size; + blk_status_t ret; if (!sd_set_special_bvec(rq, data_len)) return BLK_STS_RESOURCE; @@ -1015,7 +1031,10 @@ static blk_status_t sd_setup_write_same1 cmd->transfersize = data_len; rq->timeout = unmap ? SD_TIMEOUT : SD_WRITE_SAME_TIMEOUT; - return scsi_alloc_sgtables(cmd); + ret = scsi_alloc_sgtables(cmd); + if (ret != BLK_STS_OK) + sd_uninit_command(cmd); + return ret; } static blk_status_t sd_setup_write_same10_cmnd(struct scsi_cmnd *cmd, @@ -1027,6 +1046,7 @@ static blk_status_t sd_setup_write_same1 u64 lba = sectors_to_logical(sdp, blk_rq_pos(rq)); u32 nr_blocks = sectors_to_logical(sdp, blk_rq_sectors(rq)); u32 data_len = sdp->sector_size; + blk_status_t ret; if (!sd_set_special_bvec(rq, data_len)) return BLK_STS_RESOURCE; @@ -1042,7 +1062,10 @@ static blk_status_t sd_setup_write_same1 cmd->transfersize = data_len; rq->timeout = unmap ? SD_TIMEOUT : SD_WRITE_SAME_TIMEOUT; - return scsi_alloc_sgtables(cmd); + ret = scsi_alloc_sgtables(cmd); + if (ret != BLK_STS_OK) + sd_uninit_command(cmd); + return ret; } static blk_status_t sd_setup_write_zeroes_cmnd(struct scsi_cmnd *cmd) @@ -1466,14 +1489,6 @@ static blk_status_t sd_init_command(stru } } -static void sd_uninit_command(struct scsi_cmnd *SCpnt) -{ - struct request *rq = scsi_cmd_to_rq(SCpnt); - - if (rq->rq_flags & RQF_SPECIAL_PAYLOAD) - mempool_free(rq->special_vec.bv_page, sd_page_pool); -} - static bool sd_need_revalidate(struct gendisk *disk, struct scsi_disk *sdkp) { if (sdkp->device->removable || sdkp->write_prot) {