Commit e1fe2060 authored by Chris Boot's avatar Chris Boot Committed by Nicholas Bellinger

sbp-target: fix error path in sbp_make_tpg()

If the TPG memory is allocated successfully, but we fail further along
in the function, a dangling pointer to freed memory is left in the TPort
structure. This is mostly harmless, but does prevent re-trying the
operation without first removing the TPort altogether.
Reported-by: default avatarChen Gang <gang.chen@asianux.com>
Signed-off-by: default avatarChris Boot <bootc@bootc.net>
Cc: Andy Grover <agrover@redhat.com>
Cc: Nicholas A. Bellinger <nab@linux-iscsi.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarNicholas Bellinger <nab@linux-iscsi.org>
parent 37419d67
......@@ -2208,20 +2208,23 @@ static struct se_portal_group *sbp_make_tpg(
tport->mgt_agt = sbp_management_agent_register(tport);
if (IS_ERR(tport->mgt_agt)) {
ret = PTR_ERR(tport->mgt_agt);
kfree(tpg);
return ERR_PTR(ret);
goto out_free_tpg;
}
ret = core_tpg_register(&sbp_fabric_configfs->tf_ops, wwn,
&tpg->se_tpg, (void *)tpg,
TRANSPORT_TPG_TYPE_NORMAL);
if (ret < 0) {
sbp_management_agent_unregister(tport->mgt_agt);
kfree(tpg);
return ERR_PTR(ret);
}
if (ret < 0)
goto out_unreg_mgt_agt;
return &tpg->se_tpg;
out_unreg_mgt_agt:
sbp_management_agent_unregister(tport->mgt_agt);
out_free_tpg:
tport->tpg = NULL;
kfree(tpg);
return ERR_PTR(ret);
}
static void sbp_drop_tpg(struct se_portal_group *se_tpg)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment