svn commit: r268364 - head/sys/cam/ctl

Alexander Motin mav at FreeBSD.org
Mon Jul 7 11:52:23 UTC 2014


Author: mav
Date: Mon Jul  7 11:52:22 2014
New Revision: 268364
URL: http://svnweb.freebsd.org/changeset/base/268364

Log:
  Fix "use after free" on port creation error in r268291.

Modified:
  head/sys/cam/ctl/ctl_frontend_iscsi.c

Modified: head/sys/cam/ctl/ctl_frontend_iscsi.c
==============================================================================
--- head/sys/cam/ctl/ctl_frontend_iscsi.c	Mon Jul  7 11:05:04 2014	(r268363)
+++ head/sys/cam/ctl/ctl_frontend_iscsi.c	Mon Jul  7 11:52:22 2014	(r268364)
@@ -1945,26 +1945,26 @@ cfiscsi_ioctl_port_create(struct ctl_req
 	alias = ctl_get_opt(&opts, "cfiscsi_target_alias");
 	tag = ctl_get_opt(&opts, "cfiscsi_portal_group_tag");
 	if (target == NULL || tag == NULL) {
-		ctl_free_opts(&opts);
 		req->status = CTL_LUN_ERROR;
 		snprintf(req->error_str, sizeof(req->error_str),
 		    "Missing required argument");
+		ctl_free_opts(&opts);
 		return;
 	}
 	ct = cfiscsi_target_find_or_create(&cfiscsi_softc, target, alias);
 	if (ct == NULL) {
-		ctl_free_opts(&opts);
 		req->status = CTL_LUN_ERROR;
 		snprintf(req->error_str, sizeof(req->error_str),
 		    "failed to create target \"%s\"", target);
+		ctl_free_opts(&opts);
 		return;
 	}
 	if (ct->ct_state == CFISCSI_TARGET_STATE_ACTIVE) {
-		cfiscsi_target_release(ct);
-		ctl_free_opts(&opts);
 		req->status = CTL_LUN_ERROR;
 		snprintf(req->error_str, sizeof(req->error_str),
 		    "target \"%s\" already exist", target);
+		cfiscsi_target_release(ct);
+		ctl_free_opts(&opts);
 		return;
 	}
 	port = &ct->ct_port;


More information about the svn-src-all mailing list