Andy Grover 9e2dcd0068 target/tcm_fc: Fix use-after-free of ft_tpg ... commit 2c42be2dd4f6586728dba5c4e197afd5cfaded78 upstream. ft_del_tpg checks tpg->tport is set before unlinking the tpg from the tport when the tpg is being removed. Set this pointer in ft_tport_create, or the unlinking won't happen in ft_del_tpg and tport->tpg will reference a deleted object. This patch sets tpg->tport in ft_tport_create, because that's what ft_del_tpg checks, and is the only way to get back to the tport to clear tport->tpg. The bug was occuring when: - lport created, tport (our per-lport, per-provider context) is allocated. tport->tpg = NULL - tpg created - a PRLI is received. ft_tport_create is called, tpg is found and tport->tpg is set - tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not set, tport->tpg is not cleared and points at freed memory - Future calls to ft_tport_create return tport via first conditional, instead of searching for new tpg by calling ft_lport_find_tpg. tport->tpg is still invalid, and will access freed memory. see https://bugzilla.redhat.com/show_bug.cgi?id=1071340 Signed-off-by: Andy Grover <agrover@redhat.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-05-06 07:55:30 -07:00
..
iscsi	iscsi-target: Fix ERL=2 ASYNC_EVENT connection pointer bug	2014-05-06 07:55:30 -07:00
loopback
sbp
tcm_fc	target/tcm_fc: Fix use-after-free of ft_tpg	2014-05-06 07:55:30 -07:00
Kconfig
Makefile
target_core_alua.c	target: Fix >= v3.9+ regression in PR APTPL + ALUA metadata write-out	2013-09-26 17:18:27 -07:00
target_core_alua.h
target_core_configfs.c	target: Have dev/enable show if TCM device is configured	2013-05-03 16:46:02 -07:00
target_core_device.c	target/file: Update hw_max_sectors based on current block_size	2014-01-09 12:24:20 -08:00
target_core_fabric_configfs.c
target_core_fabric_lib.c
target_core_file.c	target/file: Update hw_max_sectors based on current block_size	2014-01-09 12:24:20 -08:00
target_core_file.h	target/file: Update hw_max_sectors based on current block_size	2014-01-09 12:24:20 -08:00
target_core_hba.c
target_core_iblock.c	target/iblock: Fix WCE=1 + DPOFUA=1 backend WRITE regression	2013-05-15 01:46:34 -07:00
target_core_iblock.h
target_core_internal.h
target_core_pr.c	target: Fix >= v3.9+ regression in PR APTPL + ALUA metadata write-out	2013-09-26 17:18:27 -07:00
target_core_pr.h
target_core_pscsi.c	target/pscsi: fix return value check	2013-11-13 12:05:32 +09:00
target_core_pscsi.h
target_core_rd.c	target/rd: Add ramdisk bit for NULLIO operation	2013-05-11 16:22:39 -07:00
target_core_rd.h	target/rd: Add ramdisk bit for NULLIO operation	2013-05-11 16:22:39 -07:00
target_core_sbc.c
target_core_spc.c	target: Fix trailing ASCII space usage in INQUIRY vendor+model	2013-09-07 22:09:59 -07:00
target_core_stat.c
target_core_tmr.c
target_core_tpg.c
target_core_transport.c	target: Propigate up ->cmd_kref put return via transport_generic_free_cmd	2013-05-31 01:21:23 -07:00
target_core_ua.c
target_core_ua.h