[PATCH] RDMA/srp: Fix potential fast registration list leak

[Guangshuo Li]

If the indirect descriptor allocation fails, srp_init_cmd_priv() returns
without freeing the fast registration list. The failed request does not
receive an exit_cmd_priv callback. Release the list on this error path.

This issue was found by our static analysis tool under development.

Fixes: ad215aaea4f9 ("RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
 drivers/infiniband/ulp/srp/ib_srp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 5811f02df980..1cea1896d162 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -996,8 +996,10 @@ static int srp_init_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
 			goto out;
 	}
 	req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL);
-	if (!req->indirect_desc)
+	if (!req->indirect_desc) {
+		kfree(req->fr_list);
 		goto out;
+	}
 
 	dma_addr = ib_dma_map_single(ibdev, req->indirect_desc,
 				     target->indirect_size,

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4