Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b53b0d99 authored by Nicholas Bellinger's avatar Nicholas Bellinger
Browse files

iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid 



This patch fixes a bug in iscsit_logout_post_handler_diffcid() where
a pointer used as storage for list_for_each_entry() was incorrectly
being used to determine if no matching entry had been found.

This patch changes iscsit_logout_post_handler_diffcid() to key off
bool conn_found to determine if the function needs to exit early.

Reported-by: default avatarJoern Engel <joern@logfs.org>
Cc: <stable@vger.kernel.org> # v3.1+
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 1f0b030c

drivers/target/iscsi/iscsi_target.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -4540,6 +4540,7 @@ static void iscsit_logout_post_handler_diffcid( 
{

{

	struct iscsi_conn *l_conn;

	struct iscsi_conn *l_conn;

	struct iscsi_session *sess = conn->sess;

	struct iscsi_session *sess = conn->sess;

	bool conn_found = false;





	if (!sess)

	if (!sess)

		return;

		return;
@@ -4548,12 +4549,13 @@ static void iscsit_logout_post_handler_diffcid( 
	list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) {

	list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) {

		if (l_conn->cid == cid) {

		if (l_conn->cid == cid) {

			iscsit_inc_conn_usage_count(l_conn);

			iscsit_inc_conn_usage_count(l_conn);

			conn_found = true;

			break;

			break;

		}

		}

	}

	}

	spin_unlock_bh(&sess->conn_lock);

	spin_unlock_bh(&sess->conn_lock);





	if (!l_conn)

	if (!conn_found)

		return;

		return;





	if (l_conn->sock)

	if (l_conn->sock)