On 11/20/20 1:48 AM, Qinglang Miao wrote:
> kfree(conn) is called inside put_device(&conn->dev) so that
> another one would cause use-after-free. Besides, device_unregister
> should be used here rather than put_device.
>
> Fixes: f3c893e3dbb5 ("scsi: iscsi: Fail session and connection on transport
> registration failure")
> Reported-by: Hulk Robot <[email protected]>
> Signed-off-by: Qinglang Miao <[email protected]>
> ---
> drivers/scsi/scsi_transport_iscsi.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/scsi_transport_iscsi.c
> b/drivers/scsi/scsi_transport_iscsi.c
> index 2eb3e4f93..2e68c0a87 100644
> --- a/drivers/scsi/scsi_transport_iscsi.c
> +++ b/drivers/scsi/scsi_transport_iscsi.c
> @@ -2313,7 +2313,9 @@ iscsi_create_conn(struct iscsi_cls_session *session,
> int dd_size, uint32_t cid)
> return conn;
>
> release_conn_ref:
> - put_device(&conn->dev);
> + device_unregister(&conn->dev);
> + put_device(&session->dev);
> + return NULL;
> release_parent_ref:
> put_device(&session->dev);
> free_conn:
>
Reviewed-by: Mike Christie <[email protected]>
--
You received this message because you are subscribed to the Google Groups
"open-iscsi" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/open-iscsi/331a17b8-3219-cb73-90c8-4b814202a78f%40oracle.com.
