nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked

[ Upstream commit becc4cac309dc867571f0080fde4426a6c2222e0 ]

Since model_number is allocated before it needs to be freed before
kmemdump_nul.

Reviewed-by: Konstantin Shelekhin <k.shelekhin@yadro.com>
Reviewed-by: Dmitriy Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Aleksandr Miloserdov <a.miloserdov@yadro.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index cea30e4..6250380 100644 (file)
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -1189,6 +1189,7 @@ static ssize_t nvmet_subsys_attr_model_store_locked(struct nvmet_subsys *subsys,
                const char *page, size_t count)
 {
        int pos = 0, len;
+       char *val;
 
        if (subsys->subsys_discovered) {
                pr_err("Can't set model number. %s is already assigned\n",
@@ -1211,9 +1212,11 @@ static ssize_t nvmet_subsys_attr_model_store_locked(struct nvmet_subsys *subsys,
                        return -EINVAL;
        }
 
-       subsys->model_number = kmemdup_nul(page, len, GFP_KERNEL);
-       if (!subsys->model_number)
+       val = kmemdup_nul(page, len, GFP_KERNEL);
+       if (!val)
                return -ENOMEM;
+       kfree(subsys->model_number);
+       subsys->model_number = val;
        return count;
 }