Re: [PATCH] target/tcm_fc: Fix use-after-free of ft_tpg

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Andy,

On Fri, 2014-04-04 at 16:44 -0700, Andy Grover wrote:
> ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
> tport when the tpg is being removed. Set this pointer in ft_tport_create,
> or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
> a deleted object.
> 
> see https://bugzilla.redhat.com/show_bug.cgi?id=1071340
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Andy Grover <agrover@xxxxxxxxxx>
> ---
>  drivers/target/tcm_fc/tfc_sess.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
> index 0475142..1329726 100644
> --- a/drivers/target/tcm_fc/tfc_sess.c
> +++ b/drivers/target/tcm_fc/tfc_sess.c
> @@ -68,6 +68,7 @@ static struct ft_tport *ft_tport_create(struct fc_lport *lport)
>  
>  	if (tport) {
>  		tport->tpg = tpg;
> +		tpg->tport = tport;
>  		return tport;
>  	}
>  

I'm confused how this addresses the bug above..?

Does this mean the bug is only triggered when a previously
configured /sys/kernel/config/target/fc/$FCOE_WWPN/$TPGT has been
removed, and then a new PLOGI picks up a left-over pointer to an
endpoint that previously had been released..?

Care to add a more detailed commit explaining the exact details..?

--nab



--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [SCSI Target Devel]     [Linux SCSI Target Infrastructure]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Linux IIO]     [Samba]     [Device Mapper]
  Powered by Linux