From 4653cd8df4c14f4eea37b6ce66277330774dd3d5 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Sun, 29 Sep 2013 21:04:48 +0200 Subject: [PATCH] iscsi_reconnect: Fix a use-after-free This patch fixes the following Valgrind complaint: Invalid read of size 4 at 0x524A858: iscsi_reconnect (connect.c:378) by 0x5258794: iscsi_service (socket.c:707) by 0x52599C4: event_loop (sync.c:67) by 0x525AFD7: iscsi_reserve6_sync (sync.c:1096) by 0x40A40A: reserve6 (iscsi-support.c:3291) by 0x422C95: test_reserve6_target_warm_reset (test_reserve6_target_warm_reset.c:39) by 0x503B05F: ??? (in /usr/lib/libcunit.so.1.0.1) by 0x503B375: ??? (in /usr/lib/libcunit.so.1.0.1) by 0x503B69F: CU_run_all_tests (in /usr/lib/libcunit.so.1.0.1) by 0x403171: main (iscsi-test-cu.c:1258) Address 0x6443958 is 3,032 bytes inside a block of size 4,120 free'd at 0x4C2B83A: free (vg_replace_malloc.c:468) by 0x524A846: iscsi_reconnect (connect.c:374) by 0x5258794: iscsi_service (socket.c:707) by 0x52599C4: event_loop (sync.c:67) by 0x525AFD7: iscsi_reserve6_sync (sync.c:1096) by 0x40A40A: reserve6 (iscsi-support.c:3291) by 0x422C95: test_reserve6_target_warm_reset (test_reserve6_target_warm_reset.c:39) by 0x503B05F: ??? (in /usr/lib/libcunit.so.1.0.1) by 0x503B375: ??? (in /usr/lib/libcunit.so.1.0.1) by 0x503B69F: CU_run_all_tests (in /usr/lib/libcunit.so.1.0.1) by 0x403171: main (iscsi-test-cu.c:1258) Signed-off-by: Bart Van Assche --- lib/connect.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/connect.c b/lib/connect.c index ee3a0ef..384cf51 100644 --- a/lib/connect.c +++ b/lib/connect.c @@ -369,13 +369,13 @@ try_again: iscsi->mallocs+=old_iscsi->mallocs; iscsi->frees+=old_iscsi->frees; + ISCSI_LOG(iscsi, 2, "reconnect was successful"); + memcpy(old_iscsi, iscsi, sizeof(struct iscsi_context)); - memset(iscsi, 0, sizeof(struct iscsi_context)); free(iscsi); old_iscsi->is_reconnecting = 0; old_iscsi->last_reconnect = time(NULL); - ISCSI_LOG(iscsi, 2, "reconnect was successful"); return 0; }