Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e1fe2060 authored by Chris Boot's avatar Chris Boot Committed by Nicholas Bellinger
Browse files

sbp-target: fix error path in sbp_make_tpg() 



If the TPG memory is allocated successfully, but we fail further along
in the function, a dangling pointer to freed memory is left in the TPort
structure. This is mostly harmless, but does prevent re-trying the
operation without first removing the TPort altogether.

Reported-by: default avatarChen Gang <gang.chen@asianux.com>
Signed-off-by: default avatarChris Boot <bootc@bootc.net>
Cc: Andy Grover <agrover@redhat.com>
Cc: Nicholas A. Bellinger <nab@linux-iscsi.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 37419d67

drivers/target/sbp/sbp_target.c

+10 −7
Original line number Diff line number Diff line
@@ -2208,22 +2208,25 @@ static struct se_portal_group *sbp_make_tpg( 
	tport->mgt_agt = sbp_management_agent_register(tport);

	if (IS_ERR(tport->mgt_agt)) {

		ret = PTR_ERR(tport->mgt_agt);

		kfree(tpg);

		return ERR_PTR(ret);

		goto out_free_tpg;

	}



	ret = core_tpg_register(&sbp_fabric_configfs->tf_ops, wwn,

			&tpg->se_tpg, (void *)tpg,

			TRANSPORT_TPG_TYPE_NORMAL);

	if (ret < 0) {

	if (ret < 0)

		goto out_unreg_mgt_agt;



	return &tpg->se_tpg;



out_unreg_mgt_agt:

	sbp_management_agent_unregister(tport->mgt_agt);

out_free_tpg:

	tport->tpg = NULL;

	kfree(tpg);

	return ERR_PTR(ret);

}



	return &tpg->se_tpg;

}



static void sbp_drop_tpg(struct se_portal_group *se_tpg)

{

	struct sbp_tpg *tpg = container_of(se_tpg, struct sbp_tpg, se_tpg);