USB: cdc_acm: Fix memory leak after hangup

[safe/jmp/linux-2.6] / drivers / scsi / scsi.c

diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 166417a..dd098ca 100644 (file)
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -241,10 +241,7 @@ scsi_host_alloc_command(struct Scsi_Host *shost, gfp_t gfp_mask)
  */
 struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
 {
-       struct scsi_cmnd *cmd;
-       unsigned char *buf;
-
-       cmd = scsi_host_alloc_command(shost, gfp_mask);
+       struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask);
 
        if (unlikely(!cmd)) {
                unsigned long flags;
@@ -258,9 +255,15 @@ struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
                spin_unlock_irqrestore(&shost->free_list_lock, flags);
 
                if (cmd) {
+                       void *buf, *prot;
+
                        buf = cmd->sense_buffer;
+                       prot = cmd->prot_sdb;
+
                        memset(cmd, 0, sizeof(*cmd));
+
                        cmd->sense_buffer = buf;
+                       cmd->prot_sdb = prot;
                }
        }
 
@@ -994,7 +997,7 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer,
         * all the existing users tried this hard.
         */
        result = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buffer,
-                                 len + 4, NULL, 30 * HZ, 3, NULL);
+                                 len, NULL, 30 * HZ, 3, NULL);
        if (result)
                return result;
 
@@ -1021,13 +1024,14 @@ unsigned char *scsi_get_vpd_page(struct scsi_device *sdev, u8 page)
 {
        int i, result;
        unsigned int len;
-       unsigned char *buf = kmalloc(259, GFP_KERNEL);
+       const unsigned int init_vpd_len = 255;
+       unsigned char *buf = kmalloc(init_vpd_len, GFP_KERNEL);
 
        if (!buf)
                return NULL;
 
        /* Ask for all the pages supported by this device */
-       result = scsi_vpd_inquiry(sdev, buf, 0, 255);
+       result = scsi_vpd_inquiry(sdev, buf, 0, init_vpd_len);
        if (result)
                goto fail;
 
@@ -1050,12 +1054,12 @@ unsigned char *scsi_get_vpd_page(struct scsi_device *sdev, u8 page)
         * Some pages are longer than 255 bytes.  The actual length of
         * the page is returned in the header.
         */
-       len = (buf[2] << 8) | buf[3];
-       if (len <= 255)
+       len = ((buf[2] << 8) | buf[3]) + 4;
+       if (len <= init_vpd_len)
                return buf;
 
        kfree(buf);
-       buf = kmalloc(len + 4, GFP_KERNEL);
+       buf = kmalloc(len, GFP_KERNEL);
        result = scsi_vpd_inquiry(sdev, buf, page, len);
        if (result)
                goto fail;
@@ -1225,8 +1229,8 @@ EXPORT_SYMBOL(__scsi_device_lookup_by_target);
  * @starget:   SCSI target pointer
  * @lun:       SCSI Logical Unit Number
  *
- * Description: Looks up the scsi_device with the specified @channel, @id, @lun
- * for a given host.  The returned scsi_device has an additional reference that
+ * Description: Looks up the scsi_device with the specified @lun for a given
+ * @starget.  The returned scsi_device has an additional reference that
  * needs to be released with scsi_device_put once you're done with it.
  **/
 struct scsi_device *scsi_device_lookup_by_target(struct scsi_target *starget,