Author: ngie
Date: Fri May 13 08:36:33 2016
New Revision: 299621
URL: https://svnweb.freebsd.org/changeset/base/299621
Log:
MFC r298669:
r298669 (by cem):
iscsi_initiator(4): Fix use-after-free, double-free
ism_stop() already destroys and frees 'sp', including a call to ic_destroy().
Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the
freed memory either.
CIDs: 1006109, 1304861
Modified:
stable/10/sys/dev/iscsi_initiator/iscsi.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/dev/iscsi_initiator/iscsi.c
==============================================================================
--- stable/10/sys/dev/iscsi_initiator/iscsi.c Fri May 13 08:34:53 2016
(r299620)
+++ stable/10/sys/dev/iscsi_initiator/iscsi.c Fri May 13 08:36:33 2016
(r299621)
@@ -807,8 +807,6 @@ iscsi_stop(void)
TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) {
//XXX: check for activity ...
ism_stop(sp);
- if(sp->cam_sim != NULL)
- ic_destroy(sp);
}
mtx_destroy(&isc->isc_mtx);
sx_destroy(&isc->unit_sx);
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "[email protected]"
