| Message ID | 1500820413-21993-1-git-send-email-varun@chelsio.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Sun, 2017-07-23 at 20:03 +0530, Varun Prakash wrote: > On receiving text request iscsi-target allocates buffer for > payload in iscsit_handle_text_cmd() and assigns buffer pointer > to cmd->text_in_ptr, this buffer is currently freed in > iscsit_release_cmd(), if iscsi-target sets 'C' bit in text > response then it will receive another text request from the > initiator with ttt != 0xffffffff in this case iscsi-target > will find cmd using itt and call iscsit_setup_text_cmd() > which will set cmd->text_in_ptr to NULL without freeing > previously allocated buffer. > > This patch fixes this issue by calling kfree(cmd->text_in_ptr) > in iscsit_setup_text_cmd() before assigning NULL to it. > > For the first text request cmd->text_in_ptr is NULL as > cmd is memset to 0 in iscsit_allocate_cmd(). > > Signed-off-by: Varun Prakash <varun@chelsio.com> > --- > drivers/target/iscsi/iscsi_target.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c > index 74e4975..2688918 100644 > --- a/drivers/target/iscsi/iscsi_target.c > +++ b/drivers/target/iscsi/iscsi_target.c > @@ -2167,6 +2167,7 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, > cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); > cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn); > cmd->data_direction = DMA_NONE; > + kfree(cmd->text_in_ptr); > cmd->text_in_ptr = NULL; > > return 0; Nice catch on this one ! Applied to target-pending/master. Thanks Varun. -- To unsubscribe from this list: send the line "unsubscribe target-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index 74e4975..2688918 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -2167,6 +2167,7 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn); cmd->data_direction = DMA_NONE; + kfree(cmd->text_in_ptr); cmd->text_in_ptr = NULL; return 0;
On receiving text request iscsi-target allocates buffer for payload in iscsit_handle_text_cmd() and assigns buffer pointer to cmd->text_in_ptr, this buffer is currently freed in iscsit_release_cmd(), if iscsi-target sets 'C' bit in text response then it will receive another text request from the initiator with ttt != 0xffffffff in this case iscsi-target will find cmd using itt and call iscsit_setup_text_cmd() which will set cmd->text_in_ptr to NULL without freeing previously allocated buffer. This patch fixes this issue by calling kfree(cmd->text_in_ptr) in iscsit_setup_text_cmd() before assigning NULL to it. For the first text request cmd->text_in_ptr is NULL as cmd is memset to 0 in iscsit_allocate_cmd(). Signed-off-by: Varun Prakash <varun@chelsio.com> --- drivers/target/iscsi/iscsi_target.c | 1 + 1 file changed, 1 insertion(+)