diff options
| author | Chris Boot <bootc@bootc.net> | 2012-12-11 21:58:48 +0000 |
|---|---|---|
| committer | Nicholas Bellinger <nab@linux-iscsi.org> | 2012-12-12 21:17:25 -0800 |
| commit | e1fe2060d7e8f58a69374135e32e90f0bb79a7fd (patch) | |
| tree | 496e995322db60717dbf31ca84f9d8753f125479 /drivers/target/sbp | |
| parent | 37419d674ca99739dbee5ada28b50aacc29c94e1 (diff) | |
sbp-target: fix error path in sbp_make_tpg()
If the TPG memory is allocated successfully, but we fail further along
in the function, a dangling pointer to freed memory is left in the TPort
structure. This is mostly harmless, but does prevent re-trying the
operation without first removing the TPort altogether.
Reported-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Chris Boot <bootc@bootc.net>
Cc: Andy Grover <agrover@redhat.com>
Cc: Nicholas A. Bellinger <nab@linux-iscsi.org>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target/sbp')
| -rw-r--r-- | drivers/target/sbp/sbp_target.c | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c index f0a2a1d982a2..2e8d06f198ae 100644 --- a/drivers/target/sbp/sbp_target.c +++ b/drivers/target/sbp/sbp_target.c @@ -2208,20 +2208,23 @@ static struct se_portal_group *sbp_make_tpg( tport->mgt_agt = sbp_management_agent_register(tport); if (IS_ERR(tport->mgt_agt)) { ret = PTR_ERR(tport->mgt_agt); - kfree(tpg); - return ERR_PTR(ret); + goto out_free_tpg; } ret = core_tpg_register(&sbp_fabric_configfs->tf_ops, wwn, &tpg->se_tpg, (void *)tpg, TRANSPORT_TPG_TYPE_NORMAL); - if (ret < 0) { - sbp_management_agent_unregister(tport->mgt_agt); - kfree(tpg); - return ERR_PTR(ret); - } + if (ret < 0) + goto out_unreg_mgt_agt; return &tpg->se_tpg; + +out_unreg_mgt_agt: + sbp_management_agent_unregister(tport->mgt_agt); +out_free_tpg: + tport->tpg = NULL; + kfree(tpg); + return ERR_PTR(ret); } static void sbp_drop_tpg(struct se_portal_group *se_tpg) |