iscsi_initiator(4): Fix use-after-free, double-free

ism_stop() already destroys and frees 'sp', including a call to ic_destroy().
Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the
freed memory either.

Reported by:	Coverity
CIDs:		1006109, 1304861
Sponsored by:	EMC / Isilon Storage Division
This commit is contained in:
Conrad Meyer 2016-04-26 21:44:08 +00:00
parent 1fb6767d27
commit 90b9cca2a8

View File

@ -804,8 +804,6 @@ iscsi_stop(void)
TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) {
//XXX: check for activity ...
ism_stop(sp);
if(sp->cam_sim != NULL)
ic_destroy(sp);
}
mtx_destroy(&isc->isc_mtx);
sx_destroy(&isc->unit_sx);