admin/libiscsi
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #338 from ddiss/pdu_cancel_use_after_free

Browse Source 
pdu: Fix use after free during cancellation
This commit is contained in:
Bart Van Assche
2020-08-18 07:00:27 -07:00
committed by GitHub
parent e9cefe7e42 87272919ad
commit 3f50a1462c
1 changed files with 1 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/pdu.c
View File

@@ -788,13 +788,11 @@ iscsi_cancel_pdus(struct iscsi_context *iscsi)
pdu->callback(iscsi, SCSI_STATUS_CANCELLED, pdu->callback(iscsi, SCSI_STATUS_CANCELLED,
NULL, pdu->private_data); NULL, pdu->private_data);
} }
iscsi->drv->free_pdu(iscsi, pdu);
if (!(pdu->outdata.data[0] & ISCSI_PDU_IMMEDIATE) && if (!(pdu->outdata.data[0] & ISCSI_PDU_IMMEDIATE) &&
(pdu->outdata.data[0] & 0x3f) != ISCSI_PDU_DATA_OUT) { (pdu->outdata.data[0] & 0x3f) != ISCSI_PDU_DATA_OUT) {
iscsi->cmdsn--; iscsi->cmdsn--;
} }
iscsi->drv->free_pdu(iscsi, pdu);
} }
while ((pdu = iscsi->waitpdu)) { while ((pdu = iscsi->waitpdu)) {
ISCSI_LIST_REMOVE(&iscsi->waitpdu, pdu); ISCSI_LIST_REMOVE(&iscsi->waitpdu, pdu);