svn commit: r299621 - stable/10/sys/dev/iscsi_initiator

[Garrett Cooper]

Author: ngie
Date: Fri May 13 08:36:33 2016
New Revision: 299621
URL: https://svnweb.freebsd.org/changeset/base/299621

Log:
  MFC r298669:
  r298669 (by cem):
  
  iscsi_initiator(4): Fix use-after-free, double-free
  
  ism_stop() already destroys and frees 'sp', including a call to ic_destroy().
  Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the
  freed memory either.
  
  CIDs:		1006109, 1304861

Modified:
  stable/10/sys/dev/iscsi_initiator/iscsi.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/iscsi_initiator/iscsi.c
==============================================================================
--- stable/10/sys/dev/iscsi_initiator/iscsi.c	Fri May 13 08:34:53 2016	(r299620)
+++ stable/10/sys/dev/iscsi_initiator/iscsi.c	Fri May 13 08:36:33 2016	(r299621)
@@ -807,8 +807,6 @@ iscsi_stop(void)
      TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) {
 	  //XXX: check for activity ...
 	  ism_stop(sp);
-	  if(sp->cam_sim != NULL)
-	       ic_destroy(sp);
      }
      mtx_destroy(&isc->isc_mtx);
      sx_destroy(&isc->unit_sx);