diff options
| author | Nicholas Bellinger | 2012-02-27 07:16:07 +0100 |
|---|---|---|
| committer | Nicholas Bellinger | 2012-03-08 21:10:56 +0100 |
| commit | d06283341aee9e48eff1b068779d340785c635ce (patch) | |
| tree | 4b6085fababdbb6784db9945968cbf6ed292e0e8 /drivers/target/iscsi | |
| parent | target: Allow target_submit_tmr interrupt context + pass ABORT_TASK tag (diff) | |
| download | kernel-qcow2-linux-d06283341aee9e48eff1b068779d340785c635ce.tar.gz kernel-qcow2-linux-d06283341aee9e48eff1b068779d340785c635ce.tar.xz kernel-qcow2-linux-d06283341aee9e48eff1b068779d340785c635ce.zip | |
iscsi-target: Fix dynamic -> explict NodeACL pointer reference
This patch fixes a free after use in lio_target_make_nodeacl() where
iscsi_node_acl was referenced from the original se_nacl_new allocation,
instead of from core_tpg_add_initiator_node_acl() in the case of dynamic
-> explict NodeACL conversion.
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target/iscsi')
| -rw-r--r-- | drivers/target/iscsi/iscsi_target_configfs.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c index 6b35b37988ed..dcef63bf5f9d 100644 --- a/drivers/target/iscsi/iscsi_target_configfs.c +++ b/drivers/target/iscsi/iscsi_target_configfs.c @@ -812,9 +812,6 @@ static struct se_node_acl *lio_target_make_nodeacl( if (!se_nacl_new) return ERR_PTR(-ENOMEM); - acl = container_of(se_nacl_new, struct iscsi_node_acl, - se_node_acl); - cmdsn_depth = ISCSI_TPG_ATTRIB(tpg)->default_cmdsn_depth; /* * se_nacl_new may be released by core_tpg_add_initiator_node_acl() @@ -825,7 +822,8 @@ static struct se_node_acl *lio_target_make_nodeacl( if (IS_ERR(se_nacl)) return se_nacl; - stats_cg = &acl->se_node_acl.acl_fabric_stat_group; + acl = container_of(se_nacl, struct iscsi_node_acl, se_node_acl); + stats_cg = &se_nacl->acl_fabric_stat_group; stats_cg->default_groups = kzalloc(sizeof(struct config_group) * 2, GFP_KERNEL); |