svn commit: r268695 - stable/10/sys/cam/ctl

Author: mav
Date: Tue Jul 15 17:16:58 2014
New Revision: 268695
URL: http://svnweb.freebsd.org/changeset/base/268695

Log:
  MFC r268364:
  Fix "use after free" on port creation error in r268291.

Modified:
  stable/10/sys/cam/ctl/ctl_frontend_iscsi.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/cam/ctl/ctl_frontend_iscsi.c
==============================================================================
--- stable/10/sys/cam/ctl/ctl_frontend_iscsi.c	Tue Jul 15 17:16:06 2014	(r268694)
+++ stable/10/sys/cam/ctl/ctl_frontend_iscsi.c	Tue Jul 15 17:16:58 2014	(r268695)
@@ -1949,26 +1949,26 @@ cfiscsi_ioctl_port_create(struct ctl_req
 	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
 	tag = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
 	if (target == NULL || tag == NULL) {
-		ctl_free_opts(&opts);
 		req->status = CTL_LUN_ERROR;
 		snprintf(req->error_str, sizeof(req->error_str),
 		    "Missing required argument");
+		ctl_free_opts(&opts);
 		return;
 	}
 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias);
 	if (ct == NULL) {
-		ctl_free_opts(&opts);
 		req->status = CTL_LUN_ERROR;
 		snprintf(req->error_str, sizeof(req->error_str),
 		    "failed to create target \"%s\"", target);
+		ctl_free_opts(&opts);
 		return;
 	}
 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
-		cfiscsi_target_release(ct);
-		ctl_free_opts(&opts);
 		req->status = CTL_LUN_ERROR;
 		snprintf(req->error_str, sizeof(req->error_str),
 		    "target \"%s\" already exist", target);
+		cfiscsi_target_release(ct);
+		ctl_free_opts(&opts);
 		return;
 	}
 	port = &ct->ct_port;
_______________________________________________
[e-mail] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[e-mail]"