iscsi_initiator(4): Fix use-after-free, double-free
ism_stop() already destroys and frees 'sp', including a call to ic_destroy(). Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the freed memory either. Reported by: Coverity CIDs: 1006109, 1304861 Sponsored by: EMC / Isilon Storage Division
This commit is contained in:
parent
1fb6767d27
commit
90b9cca2a8
@ -804,8 +804,6 @@ iscsi_stop(void)
|
||||
TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) {
|
||||
//XXX: check for activity ...
|
||||
ism_stop(sp);
|
||||
if(sp->cam_sim != NULL)
|
||||
ic_destroy(sp);
|
||||
}
|
||||
mtx_destroy(&isc->isc_mtx);
|
||||
sx_destroy(&isc->unit_sx);
|
||||
|
Loading…
Reference in New Issue
Block a user