[PATCH] target/tcm_fc: Fix use-after-free of ft_tpg

This can happen: - lport created, tport (our per-lport, per-provider context) is allocated. tport->tpg = NULL - tpg created - a PRLI is received. ft_tport_create is called, tpg is found and tport->tpg is set - tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not set, tport->t

Re: [PATCH] target/tcm_fc: Fix use-after-free of ft_tpg

Hi Andy, On Fri, 2014-04-04 at 16:44 -0700, Andy Grover wrote: > ft_del_tpg checks tpg->tport is set before unlinking the tpg from the > tport when the tpg is being removed. Set this pointer in ft_tport_create, > or the unlinking won't happen in ft_del_tpg and tport->tpg will reference > a deleted

[PATCH] target/tcm_fc: Fix use-after-free of ft_tpg

ft_del_tpg checks tpg->tport is set before unlinking the tpg from the tport when the tpg is being removed. Set this pointer in ft_tport_create, or the unlinking won't happen in ft_del_tpg and tport->tpg will reference a deleted object. see https://bugzilla.redhat.com/show_bug.cgi?id=1071340 Cc: s