svn commit: r298669 - head/sys/dev/iscsi_initiator

[Conrad E. Meyer]

Author: cem
Date: Tue Apr 26 21:44:08 2016
New Revision: 298669
URL: https://svnweb.freebsd.org/changeset/base/298669

Log:
  iscsi_initiator(4): Fix use-after-free, double-free
  
  ism_stop() already destroys and frees 'sp', including a call to ic_destroy().
  Don't dereference 'sp' after ism_stop() and don't invoke ic_destroy() on the
  freed memory either.
  
  Reported by:	Coverity
  CIDs:		1006109, 1304861
  Sponsored by:	EMC / Isilon Storage Division

Modified:
  head/sys/dev/iscsi_initiator/iscsi.c

Modified: head/sys/dev/iscsi_initiator/iscsi.c
==============================================================================
--- head/sys/dev/iscsi_initiator/iscsi.c	Tue Apr 26 21:19:12 2016	(r298668)
+++ head/sys/dev/iscsi_initiator/iscsi.c	Tue Apr 26 21:44:08 2016	(r298669)
@@ -804,8 +804,6 @@ iscsi_stop(void)
      TAILQ_FOREACH_SAFE(sp, &isc->isc_sess, sp_link, sp_tmp) {
 	  //XXX: check for activity ...
 	  ism_stop(sp);
-	  if(sp->cam_sim != NULL)
-	       ic_destroy(sp);
      }
      mtx_destroy(&isc->isc_mtx);
      sx_destroy(&isc->unit_sx);