On 11/20/20 1:48 AM, Qinglang Miao wrote: > kfree(conn) is called inside put_device(&conn->dev) so that > another one would cause use-after-free. Besides, device_unregister > should be used here rather than put_device. > > Fixes: f3c893e3dbb5 ("scsi: iscsi: Fail session and connection on transport > registration failure") > Reported-by: Hulk Robot <hul...@huawei.com> > Signed-off-by: Qinglang Miao <miaoqingl...@huawei.com> > --- > drivers/scsi/scsi_transport_iscsi.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/scsi/scsi_transport_iscsi.c > b/drivers/scsi/scsi_transport_iscsi.c > index 2eb3e4f93..2e68c0a87 100644 > --- a/drivers/scsi/scsi_transport_iscsi.c > +++ b/drivers/scsi/scsi_transport_iscsi.c > @@ -2313,7 +2313,9 @@ iscsi_create_conn(struct iscsi_cls_session *session, > int dd_size, uint32_t cid) > return conn; > > release_conn_ref: > - put_device(&conn->dev); > + device_unregister(&conn->dev); > + put_device(&session->dev); > + return NULL; > release_parent_ref: > put_device(&session->dev); > free_conn: >
Reviewed-by: Mike Christie <michael.chris...@oracle.com> -- You received this message because you are subscribed to the Google Groups "open-iscsi" group. To unsubscribe from this group and stop receiving emails from it, send an email to open-iscsi+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/open-iscsi/331a17b8-3219-cb73-90c8-4b814202a78f%40oracle.com.