diff options
| author | cem <cem@FreeBSD.org> | 2016-04-26 21:44:08 +0000 |
|---|---|---|
| committer | cem <cem@FreeBSD.org> | 2016-04-26 21:44:08 +0000 |
| commit | c8822142748632918f0eee1fd03f70dee8027cbb (patch) | |
| tree | 19a748f70e2c52d559b0fa10363a902e8a45f8ec /sys/dev | |
| parent | 6043e5f56ba90240810b5564b78f0dad78faee01 (diff) | |
| download | FreeBSD-src-c8822142748632918f0eee1fd03f70dee8027cbb.zip FreeBSD-src-c8822142748632918f0eee1fd03f70dee8027cbb.tar.gz | |
iscsi_initiator(4): Fix use-after-free, double-free
ism_stop() already destroys and frees 'sp', including a call to ic_destroy().
Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the
freed memory either.
Reported by: Coverity
CIDs: 1006109, 1304861
Sponsored by: EMC / Isilon Storage Division
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/iscsi_initiator/iscsi.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/sys/dev/iscsi_initiator/iscsi.c b/sys/dev/iscsi_initiator/iscsi.c index 049c111..99f727e 100644 --- a/sys/dev/iscsi_initiator/iscsi.c +++ b/sys/dev/iscsi_initiator/iscsi.c @@ -804,8 +804,6 @@ iscsi_stop(void) TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) { //XXX: check for activity ... ism_stop(sp); - if(sp->cam_sim != NULL) - ic_destroy(sp); } mtx_destroy(&isc->isc_mtx); sx_destroy(&isc->unit_sx); |
