lkml.org 
[lkml]   [2017]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 069/250] target/iscsi: Fix double free in lio_target_tiqn_addtpg()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit a91918cd3ea11f91c68e08e1e8ce1b560447a80e upstream.

    This iscsit_tpg_add_portal_group() function is only called from
    lio_target_tiqn_addtpg(). Both functions free the "tpg" pointer on
    error so it's a double free bug. The memory is allocated in the caller
    so it should be freed in the caller and not here.

    Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: David Disseldorp <ddiss@suse.de>
    [ bvanassche: Added "Fix" at start of patch title ]
    Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    drivers/target/iscsi/iscsi_target_tpg.c | 1 -
    1 file changed, 1 deletion(-)

    diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
    index 75a4e83..a6801e8 100644
    --- a/drivers/target/iscsi/iscsi_target_tpg.c
    +++ b/drivers/target/iscsi/iscsi_target_tpg.c
    @@ -256,7 +256,6 @@ err_out:
    iscsi_release_param_list(tpg->param_list);
    tpg->param_list = NULL;
    }
    - kfree(tpg);
    return -ENOMEM;
    }

    --
    2.8.0.rc2.1.gbe9624a
    \
     
     \ /
      Last update: 2017-06-12 01:14    [W:4.048 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site