this seems to be a straight forward case of memory not being freed on an error path. so i just added in one line to each of the if statements that could fail. -john martin --- drivers/scsi/scsi_ioctl.c.orig Fri Apr 27 13:59:19 2001 +++ drivers/scsi/scsi_ioctl.c Sat May 26 20:13:03 2001 @@ -317,10 +317,16 @@ sb_len = (sb_len > OMAX_SB_LEN) ? OMAX_SB_LEN : sb_len; if (copy_to_user(cmd_in, SRpnt->sr_sense_buffer, sb_len)) + { + scsi_release_request(SRpnt); return -EFAULT; + } } else if (copy_to_user(cmd_in, buf, outlen)) + { + scsi_release_request(SRpnt); return -EFAULT; + } result = SRpnt->sr_result; - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/