releases/4.4.103/fix-a-page-leak-in-vhost_scsi_iov_to_sgl-error-recovery.patch

   1 From 11d49e9d089ccec81be87c2386dfdd010d7f7f6e Mon Sep 17 00:00:00 2001
   2 From: Al Viro <viro@zeniv.linux.org.uk>
   3 Date: Sun, 24 Sep 2017 18:36:44 -0400
   4 Subject: fix a page leak in vhost_scsi_iov_to_sgl() error recovery
   5
   6 From: Al Viro <viro@zeniv.linux.org.uk>
   7
   8 commit 11d49e9d089ccec81be87c2386dfdd010d7f7f6e upstream.
   9
  10 we are advancing sg as we go, so the pages we need to drop in
  11 case of error are *before* the current sg.
  12
  13 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
  14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  15
  16 ---
  17  drivers/vhost/scsi.c |    5 +++--
  18  1 file changed, 3 insertions(+), 2 deletions(-)
  19
  20 --- a/drivers/vhost/scsi.c
  21 +++ b/drivers/vhost/scsi.c
  22 @@ -703,6 +703,7 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_
  23                       struct scatterlist *sg, int sg_count)
  24  {
  25         size_t off = iter->iov_offset;
  26 +       struct scatterlist *p = sg;
  27         int i, ret;
  28
  29         for (i = 0; i < iter->nr_segs; i++) {
  30 @@ -711,8 +712,8 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_
  31
  32                 ret = vhost_scsi_map_to_sgl(cmd, base, len, sg, write);
  33                 if (ret < 0) {
  34 -                       for (i = 0; i < sg_count; i++) {
  35 -                               struct page *page = sg_page(&sg[i]);
  36 +                       while (p < sg) {
  37 +                               struct page *page = sg_page(p++);
  38                                 if (page)
  39                                         put_page(page);
  40                         }