summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorngie <ngie@FreeBSD.org>2016-05-13 08:36:33 +0000
committerngie <ngie@FreeBSD.org>2016-05-13 08:36:33 +0000
commit73cdda036c18ff64b093d5ae3e16e88c6274e81e (patch)
treee4578d17192cee1cd0019b836b7da222a4c9229b
parent20d9f6b6ed8af3d62d7b5f723782c065bb71fe69 (diff)
downloadFreeBSD-src-73cdda036c18ff64b093d5ae3e16e88c6274e81e.zip
FreeBSD-src-73cdda036c18ff64b093d5ae3e16e88c6274e81e.tar.gz
MFC r298669:
r298669 (by cem): iscsi_initiator(4): Fix use-after-free, double-free ism_stop() already destroys and frees 'sp', including a call to ic_destroy(). Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the freed memory either. CIDs: 1006109, 1304861
-rw-r--r--sys/dev/iscsi_initiator/iscsi.c2
1 files changed, 0 insertions, 2 deletions
diff --git a/sys/dev/iscsi_initiator/iscsi.c b/sys/dev/iscsi_initiator/iscsi.c
index cd66a36..b914a20 100644
--- a/sys/dev/iscsi_initiator/iscsi.c
+++ b/sys/dev/iscsi_initiator/iscsi.c
@@ -807,8 +807,6 @@ iscsi_stop(void)
TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) {
//XXX: check for activity ...
ism_stop(sp);
- if(sp->cam_sim != NULL)
- ic_destroy(sp);
}
mtx_destroy(&isc->isc_mtx);
sx_destroy(&isc->unit_sx);
OpenPOWER on IntegriCloud