Re: [PATCH] iscsi-target: Fix memory leak if iscsit_alloc_buffs() fails

[Roland Dreier <roland@kernel.org>]

On Fri, Feb 24, 2012 at 5:17 PM, Nicholas A. Bellinger
<nab@linux-iscsi.org> wrote:
> This looks like a double free here on the second failure of
> iscsit_allocate_iovecs().  Fixing this up now to drop the extra bogus
> kfree(cmd->t_mem_sg) here..

I don't see how the patch you committed:

--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -830,7 +830,7 @@ page_alloc_failed:
                __free_page(sg_page(&sgl[i]));
                i--;
        }
-       kfree(cmd->t_mem_sg);
+       kfree(sgl);
        cmd->t_mem_sg = NULL;
        return -ENOMEM;
 }

could possibly be right... you drop the kfree() of cmd->t_mem_sg but leave
in the "cmd->t_mem_sg = NULL".  Isn't that a guaranteed leak of cmd->t_mem_sg?

I think the old code was probably OK (although I get lost a bit in the
twisty maze of what exactly happens to the cmd on this failure path), and
maybe the new code would be OK if you got rid of the "cmd->t_mem_sg = NULL".

 - R.