On Sun, 2017-07-23 at 20:03 +0530, Varun Prakash wrote: > On receiving text request iscsi-target allocates buffer for > payload in iscsit_handle_text_cmd() and assigns buffer pointer > to cmd->text_in_ptr, this buffer is currently freed in > iscsit_release_cmd(), if iscsi-target sets 'C' bit in text > response then it will receive another text request from the > initiator with ttt != 0xffffffff in this case iscsi-target > will find cmd using itt and call iscsit_setup_text_cmd() > which will set cmd->text_in_ptr to NULL without freeing > previously allocated buffer. > > This patch fixes this issue by calling kfree(cmd->text_in_ptr) > in iscsit_setup_text_cmd() before assigning NULL to it. > > For the first text request cmd->text_in_ptr is NULL as > cmd is memset to 0 in iscsit_allocate_cmd(). > > Signed-off-by: Varun Prakash <varun@xxxxxxxxxxx> > --- > drivers/target/iscsi/iscsi_target.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c > index 74e4975..2688918 100644 > --- a/drivers/target/iscsi/iscsi_target.c > +++ b/drivers/target/iscsi/iscsi_target.c > @@ -2167,6 +2167,7 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, > cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); > cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn); > cmd->data_direction = DMA_NONE; > + kfree(cmd->text_in_ptr); > cmd->text_in_ptr = NULL; > > return 0; Nice catch on this one ! Applied to target-pending/master. Thanks Varun. -- To unsubscribe from this list: send the line "unsubscribe target-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
