From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AE272F746E for ; Thu, 4 Sep 2025 09:42:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756978968; cv=none; b=CTHsBOHjarsqxtQdAUkTyRQUrOyfFjHGT5/TJDPuJLl0LyaROuPBqp70jLJZKq3dB6JBx0vjdxNChjSpIfLQ4oMTaohSxuI3iImf61U+rVE4bbsgijyANyt7el63Nc1Hu1GzZ0NPpc6m/p3gAX8Pe9LqnnjI+blIKWQV/PhHXtU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756978968; c=relaxed/simple; bh=dKCx85s/6PwtEqwRZtinMLXnxG+yVQJWnrxtNuzd434=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fayLMwayd4IfG/W5RG3vs1A3fvCtSCJ2GrjG8ohZhaf8Wn3rpjXljOrKXpUehcwDGeJE9mT08rCHMM5B4Jtc85IpqRA0RNt5MscPU/eKJGeNTqCCplEeHeXL1fggDs+eikb7XaPVdTUcVBc8H5DPh+Dx76J3QOpVTaG8Sk4t+F4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=aKqkOLQM; arc=none smtp.client-ip=91.218.175.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="aKqkOLQM" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1756978963; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=lHA5A5Q3mB9GbMIkMKtbrVhd8m+plyRqseHgs1TRbeY=; b=aKqkOLQMgbO4+7frBfBUbcoiWzeR8dN6X7akim7VfBkIUKSOttKqvsiL/dCdtKM0mZ5h4U YCgZgqlhDrmgXiIYADVfwsaiACYxWwmQphtlTlFe3gPMvMnXg83tNwlSc04KaGwiSeguzR c/pYA2Rllbm4v2bUeu9mUZQ5vGhm5yY= From: Thorsten Blum To: Don Brace , "James E.J. Bottomley" , "Martin K. Petersen" , Alex Chiang , James Bottomley , Andrew Morton , "Stephen M. Cameron" , Mike Miller Cc: Thorsten Blum , stable@vger.kernel.org, storagedev@microchip.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl() Date: Thu, 4 Sep 2025 11:41:31 +0200 Message-ID: <20250904094130.276350-2-thorsten.blum@linux.dev> Precedence: bulk X-Mailing-List: linux-scsi@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT Replace kmalloc() followed by copy_from_user() with memdup_user() to fix a memory leak that occurs when copy_from_user(buff[sg_used],,) fails and the 'cleanup1:' path does not free the memory for 'buff[sg_used]'. Using memdup_user() avoids this by freeing the memory internally. Since memdup_user() already allocates memory, use kzalloc() in the else branch instead of manually zeroing 'buff[sg_used]' using memset(0). Cc: stable@vger.kernel.org Fixes: edd163687ea5 ("[SCSI] hpsa: add driver for HP Smart Array controllers.") Signed-off-by: Thorsten Blum --- drivers/scsi/hpsa.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c index c73a71ac3c29..1c6161d0b85c 100644 --- a/drivers/scsi/hpsa.c +++ b/drivers/scsi/hpsa.c @@ -6522,18 +6522,21 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, while (left) { sz = (left > ioc->malloc_size) ? ioc->malloc_size : left; buff_size[sg_used] = sz; - buff[sg_used] = kmalloc(sz, GFP_KERNEL); - if (buff[sg_used] == NULL) { - status = -ENOMEM; - goto cleanup1; - } + if (ioc->Request.Type.Direction & XFER_WRITE) { - if (copy_from_user(buff[sg_used], data_ptr, sz)) { - status = -EFAULT; + buff[sg_used] = memdup_user(data_ptr, sz); + if (IS_ERR(buff[sg_used])) { + status = PTR_ERR(buff[sg_used]); goto cleanup1; } - } else - memset(buff[sg_used], 0, sz); + } else { + buff[sg_used] = kzalloc(sz, GFP_KERNEL); + if (!buff[sg_used]) { + status = -ENOMEM; + goto cleanup1; + } + } + left -= sz; data_ptr += sz; sg_used++; -- 2.51.0