mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
![]() ft_del_tpg checks tpg->tport is set before unlinking the tpg from the tport when the tpg is being removed. Set this pointer in ft_tport_create, or the unlinking won't happen in ft_del_tpg and tport->tpg will reference a deleted object. This patch sets tpg->tport in ft_tport_create, because that's what ft_del_tpg checks, and is the only way to get back to the tport to clear tport->tpg. The bug was occuring when: - lport created, tport (our per-lport, per-provider context) is allocated. tport->tpg = NULL - tpg created - a PRLI is received. ft_tport_create is called, tpg is found and tport->tpg is set - tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not set, tport->tpg is not cleared and points at freed memory - Future calls to ft_tport_create return tport via first conditional, instead of searching for new tpg by calling ft_lport_find_tpg. tport->tpg is still invalid, and will access freed memory. see https://bugzilla.redhat.com/show_bug.cgi?id=1071340 Cc: stable@vger.kernel.org # 3.0+ Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> |
||
---|---|---|
.. | ||
iscsi | ||
loopback | ||
sbp | ||
tcm_fc | ||
Kconfig | ||
Makefile | ||
target_core_alua.c | ||
target_core_alua.h | ||
target_core_configfs.c | ||
target_core_device.c | ||
target_core_fabric_configfs.c | ||
target_core_fabric_lib.c | ||
target_core_file.c | ||
target_core_file.h | ||
target_core_hba.c | ||
target_core_iblock.c | ||
target_core_iblock.h | ||
target_core_internal.h | ||
target_core_pr.c | ||
target_core_pr.h | ||
target_core_pscsi.c | ||
target_core_pscsi.h | ||
target_core_rd.c | ||
target_core_rd.h | ||
target_core_sbc.c | ||
target_core_spc.c | ||
target_core_stat.c | ||
target_core_tmr.c | ||
target_core_tpg.c | ||
target_core_transport.c | ||
target_core_ua.c | ||
target_core_ua.h | ||
target_core_xcopy.c | ||
target_core_xcopy.h |