[PATCH v2 4/6] sg: fix double free of long scsi commands

[Douglas Gilbert <dgilbert@interlog.com>]

In the post: "[syzbot] KASAN: invalid-free in sg_finish_scsi_blk_rq"
on 20210315 to the linux-scsi list KASAN reported a double free.
Remove the offending scsi_req_free_cmd(scsi_rp) call and note
with a comment where the change in ownership of long SCSI command
(> 16 bytes long) takes place.

Reported-by: syzbot+0a0e8ecea895d38332e6@syzkaller.appspotmail.com
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
---
 drivers/scsi/sg.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index b6e06e039d5b..c49f87c97dd4 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -3097,16 +3097,14 @@ sg_start_req(struct sg_request *srp, struct sg_comm_wr_t *cwrp, int dxfer_dir)
 		set_bit(SG_FFD_HIPRI_SEEN, sfp->ffd_bm);
 
 	if (cwrp->cmd_len > BLK_MAX_CDB)
-		scsi_rp->cmd = long_cmdp;
+		scsi_rp->cmd = long_cmdp;	/* transfer ownership */
 	if (cwrp->u_cmdp)
 		res = sg_fetch_cmnd(cwrp->filp, sfp, cwrp->u_cmdp,
 				    cwrp->cmd_len, scsi_rp->cmd);
 	else
 		res = -EPROTO;
-	if (res) {
-		kfree(long_cmdp);
-		return res;
-	}
+	if (res)
+		goto fini;
 	scsi_rp->cmd_len = cwrp->cmd_len;
 	srp->cmd_opcode = scsi_rp->cmd[0];
 	us_xfer = !(rq_flags & (SG_FLAG_NO_DXFER | SG_FLAG_MMAP_IO));
@@ -3178,7 +3176,6 @@ sg_start_req(struct sg_request *srp, struct sg_comm_wr_t *cwrp, int dxfer_dir)
 	}
 fini:
 	if (unlikely(res)) {		/* failure, free up resources */
-		scsi_req_free_cmd(scsi_rp);
 		if (likely(!test_and_set_bit(SG_FRQ_BLK_PUT_REQ,
 					     srp->frq_bm))) {
 			srp->rq = NULL;
-- 
2.25.1