svn commit: r298669 - head/sys/dev/iscsi_initiator

[Oliver Pinter]

On Tue, Apr 26, 2016 at 11:44 PM, Conrad E. Meyer <cem at freebsd.org> wrote:
> Author: cem
> Date: Tue Apr 26 21:44:08 2016
> New Revision: 298669
> URL: https://svnweb.freebsd.org/changeset/base/298669
>
> Log:
>   iscsi_initiator(4): Fix use-after-free, double-free
>
>   ism_stop() already destroys and frees 'sp', including a call to ic_destroy().
>   Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the
>   freed memory either.
>
>   Reported by:  Coverity
>   CIDs:         1006109, 1304861
>   Sponsored by: EMC / Isilon Storage Division

MFC of this commit?

>
> Modified:
>   head/sys/dev/iscsi_initiator/iscsi.c
>
> Modified: head/sys/dev/iscsi_initiator/iscsi.c
> ==============================================================================
> --- head/sys/dev/iscsi_initiator/iscsi.c        Tue Apr 26 21:19:12 2016        (r298668)
> +++ head/sys/dev/iscsi_initiator/iscsi.c        Tue Apr 26 21:44:08 2016        (r298669)
> @@ -804,8 +804,6 @@ iscsi_stop(void)
>       TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) {
>           //XXX: check for activity ...
>           ism_stop(sp);
> -         if(sp->cam_sim != NULL)
> -              ic_destroy(sp);
>       }
>       mtx_destroy(&isc->isc_mtx);
>       sx_destroy(&isc->unit_sx);
> _______________________________________________
> svn-src-head at freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/svn-src-head
> To unsubscribe, send any mail to "svn-src-head-unsubscribe at freebsd.org"