Date: Tue, 26 Apr 2016 21:44:09 +0000 (UTC) From: "Conrad E. Meyer" <cem@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r298669 - head/sys/dev/iscsi_initiator Message-ID: <201604262144.u3QLi9ZX061166@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: cem Date: Tue Apr 26 21:44:08 2016 New Revision: 298669 URL: https://svnweb.freebsd.org/changeset/base/298669 Log: iscsi_initiator(4): Fix use-after-free, double-free ism_stop() already destroys and frees 'sp', including a call to ic_destroy(). Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the freed memory either. Reported by: Coverity CIDs: 1006109, 1304861 Sponsored by: EMC / Isilon Storage Division Modified: head/sys/dev/iscsi_initiator/iscsi.c Modified: head/sys/dev/iscsi_initiator/iscsi.c ============================================================================== --- head/sys/dev/iscsi_initiator/iscsi.c Tue Apr 26 21:19:12 2016 (r298668) +++ head/sys/dev/iscsi_initiator/iscsi.c Tue Apr 26 21:44:08 2016 (r298669) @@ -804,8 +804,6 @@ iscsi_stop(void) TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) { //XXX: check for activity ... ism_stop(sp); - if(sp->cam_sim != NULL) - ic_destroy(sp); } mtx_destroy(&isc->isc_mtx); sx_destroy(&isc->unit_sx);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201604262144.u3QLi9ZX061166>