diff options
author | Andy Grover <agrover@redhat.com> | 2014-04-04 23:44:37 (GMT) |
---|---|---|
committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2014-04-11 22:27:23 (GMT) |
commit | 2c42be2dd4f6586728dba5c4e197afd5cfaded78 (patch) | |
tree | c61b0900f34e9d54e8f576b8abadaeb251fb8129 /MAINTAINERS | |
parent | 47b1584c1c95f0bb4d646c47de1c0455bb5cef54 (diff) | |
download | linux-2c42be2dd4f6586728dba5c4e197afd5cfaded78.tar.xz |
target/tcm_fc: Fix use-after-free of ft_tpg
ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
tport when the tpg is being removed. Set this pointer in ft_tport_create,
or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
a deleted object.
This patch sets tpg->tport in ft_tport_create, because that's what
ft_del_tpg checks, and is the only way to get back to the tport to
clear tport->tpg.
The bug was occuring when:
- lport created, tport (our per-lport, per-provider context) is
allocated.
tport->tpg = NULL
- tpg created
- a PRLI is received. ft_tport_create is called, tpg is found and
tport->tpg is set
- tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
set, tport->tpg is not cleared and points at freed memory
- Future calls to ft_tport_create return tport via first conditional,
instead of searching for new tpg by calling ft_lport_find_tpg.
tport->tpg is still invalid, and will access freed memory.
see https://bugzilla.redhat.com/show_bug.cgi?id=1071340
Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: Andy Grover <agrover@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'MAINTAINERS')
0 files changed, 0 insertions, 0 deletions