| From b17d04abf640df85f67b047ec8f7f445394580b0 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Tue, 13 Dec 2016 15:27:04 +0300 |
| Subject: [PATCH] target/iscsi: Fix double free in lio_target_tiqn_addtpg() |
| |
| commit a91918cd3ea11f91c68e08e1e8ce1b560447a80e upstream. |
| |
| This iscsit_tpg_add_portal_group() function is only called from |
| lio_target_tiqn_addtpg(). Both functions free the "tpg" pointer on |
| error so it's a double free bug. The memory is allocated in the caller |
| so it should be freed in the caller and not here. |
| |
| Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Reviewed-by: David Disseldorp <ddiss@suse.de> |
| [ bvanassche: Added "Fix" at start of patch title ] |
| Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c |
| index 0814e5894a96..205a509b0dfb 100644 |
| --- a/drivers/target/iscsi/iscsi_target_tpg.c |
| +++ b/drivers/target/iscsi/iscsi_target_tpg.c |
| @@ -260,7 +260,6 @@ err_out: |
| iscsi_release_param_list(tpg->param_list); |
| tpg->param_list = NULL; |
| } |
| - kfree(tpg); |
| return -ENOMEM; |
| } |
| |
| -- |
| 2.10.1 |
| |
