• Andy Grover's avatar
    target/tcm_fc: Fix use-after-free of ft_tpg · 2c42be2d
    Andy Grover authored
    ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
    tport when the tpg is being removed. Set this pointer in ft_tport_create,
    or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
    a deleted object.
    
    This patch sets tpg->tport in ft_tport_create, because that's what
    ft_del_tpg checks, and is the only way to get back to the tport to
    clear tport->tpg.
    
    The bug was occuring when:
    
    - lport created, tport (our per-lport, per-provider context) is
      allocated.
      tport->tpg = NULL
    - tpg created
    - a PRLI is received. ft_tport_create is called, tpg is found and
      tport->tpg is set
    - tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
      set, tport->tpg is not cleared and points at freed memory
    - Future calls to ft_tport_create return tport via first conditional,
      instead of searching for new tpg by calling ft_lport_find_tpg.
      tport->tpg is still invalid, and will access freed memory.
    
    see https://bugzilla.redhat.com/show_bug.cgi?id=1071340
    
    Cc: stable@vger.kernel.org # 3.0+
    Signed-off-by: default avatarAndy Grover <agrover@redhat.com>
    Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
    2c42be2d
tfc_sess.c 11.6 KB