• David Jeffery's avatar
    [SCSI] st: fix memory leak with >1MB tape I/O · 7c018a90
    David Jeffery authored
    There is a memory leak in the st driver when sending large enough reads or
    writes using st's direct I/O path.  As part of mapping the application's
    memory, a buffer to hold page pointers is allocated and the count of mapped
    pages is stored in field do_dio.  A non-zero do_dio marks that direct I/O is
    in use.
    
    But do_dio is only 1 byte in size.  Mapping 256 4k pages overflows
    do_dio and causes it to be set to 0, like direct I/O option was not
    used.  When the I/O completes, the buffer to hold the page pointers is
    not freed, and the page counts of the mapped pages are not reduced.
    Every I/O of this size then leaks memory.
    
    The size of do_dio needs to be increased to prevent it wrapping around.
    Signed-off-by: default avatarDavid Jeffery <djeffery@redhat.com>
    Acked-by: default avatarKai Mäkisara <kai.makisara@kolumbus.fi>
    Signed-off-by: default avatarJames Bottomley <JBottomley@Parallels.com>
    7c018a90
st.h 6.14 KB