commit 4790b03d308f6c7dea7dc6941ddab9867c9530b8
author Paolo Bonzini <pbonzini@redhat.com> Tue Jan 22 17:34:29 2013 +0100
committer Paolo Bonzini <pbonzini@redhat.com> Thu Jan 24 15:37:55 2013 +0100
tree 28bb95e19bbd65ad77005738575184ef63d545b2
parent 3f668b6c5dc9747d0367837532c3b2ce0520cc17

iscsi: do not leak acb->buf when commands are aborted

acb->buf is freed in the WRITE(16) callback, but this may not
get called at all when commands are aborted.  Add another
free in the ABORT TASK callback, which requires setting acb->buf
to NULL everywhere.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

block/iscsi.c

diff --git a/block/iscsi.c b/block/iscsi.c
index fd54a15..b647201 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -77,6 +77,9 @@
 
     qemu_bh_delete(acb->bh);
 
+    g_free(acb->buf);
+    acb->buf = NULL;
+
     if (acb->canceled == 0) {
         acb->common.cb(acb->common.opaque, acb->status);
     }
@@ -198,6 +201,7 @@
     trace_iscsi_aio_write16_cb(iscsi, status, acb, acb->canceled);
 
     g_free(acb->buf);
+    acb->buf = NULL;
 
     if (acb->canceled != 0) {
         return;
@@ -241,6 +245,7 @@
     acb->canceled   = 0;
     acb->bh         = NULL;
     acb->status     = -EINPROGRESS;
+    acb->buf        = NULL;
 
     /* XXX we should pass the iovec to write16 to avoid the extra copy */
     /* this will allow us to get rid of 'buf' completely */
@@ -249,7 +254,6 @@
 
     /* if the iovec only contains one buffer we can pass it directly */
     if (acb->qiov->niov == 1) {
-        acb->buf = NULL;
         data.data = acb->qiov->iov[0].iov_base;
     } else {
         acb->buf = g_malloc(data.size);
@@ -440,6 +444,7 @@
     acb->canceled   = 0;
     acb->bh         = NULL;
     acb->status     = -EINPROGRESS;
+    acb->buf        = NULL;
 
     acb->task = iscsi_synchronizecache10_task(iscsi, iscsilun->lun,
                                          0, 0, 0, 0,
@@ -493,6 +498,7 @@
     acb->canceled   = 0;
     acb->bh         = NULL;
     acb->status     = -EINPROGRESS;
+    acb->buf        = NULL;
 
     list[0].lba = sector_qemu2lun(sector_num, iscsilun);
     list[0].num = nb_sectors * BDRV_SECTOR_SIZE / iscsilun->block_size;