[patch] target/iscsi: double free in lio_target_tiqn_addtpg()

[patch] target/iscsi: double free in lio_target_tiqn_addtpg()

[Dan Carpenter]

This iscsit_tpg_add_portal_group() function is only called from
lio_target_tiqn_addtpg().  Both functions free the "tpg" pointer on
error so it's a double free bug.  The memory is allocated in the caller
so it should be freed in the caller and not here.

Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
index 0814e5894a96..205a509b0dfb 100644
--- a/drivers/target/iscsi/iscsi_target_tpg.c
+++ b/drivers/target/iscsi/iscsi_target_tpg.c
@@ -260,7 +260,6 @@ int iscsit_tpg_add_portal_group(struct iscsi_tiqn *tiqn, struct iscsi_portal_gro
 		iscsi_release_param_list(tpg->param_list);
 		tpg->param_list = NULL;
 	}
-	kfree(tpg);
 	return -ENOMEM;
 }
 

Re: [patch] target/iscsi: double free in lio_target_tiqn_addtpg()

[David Disseldorp]

On Tue, 13 Dec 2016 15:27:04 +0300, Dan Carpenter wrote:

> This iscsit_tpg_add_portal_group() function is only called from
> lio_target_tiqn_addtpg().  Both functions free the "tpg" pointer on
> error so it's a double free bug.  The memory is allocated in the caller
> so it should be freed in the caller and not here.
> 
> Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
> index 0814e5894a96..205a509b0dfb 100644
> --- a/drivers/target/iscsi/iscsi_target_tpg.c
> +++ b/drivers/target/iscsi/iscsi_target_tpg.c
> @@ -260,7 +260,6 @@ int iscsit_tpg_add_portal_group(struct iscsi_tiqn *tiqn, struct iscsi_portal_gro
>  		iscsi_release_param_list(tpg->param_list);
>  		tpg->param_list = NULL;
>  	}
> -	kfree(tpg);
>  	return -ENOMEM;
>  }

Looks good, and works for me if I manually trigger the error path.
Reviewed-by: David Disseldorp <ddiss@suse.de>

Re: [patch] target/iscsi: double free in lio_target_tiqn_addtpg()

[Bart Van Assche]

On 12/13/2016 01:27 PM, Dan Carpenter wrote:
> This iscsit_tpg_add_portal_group() function is only called from
> lio_target_tiqn_addtpg().  Both functions free the "tpg" pointer on
> error so it's a double free bug.  The memory is allocated in the caller
> so it should be freed in the caller and not here.
> 
> Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Hello Dan,

Do you think a "Cc: stable" tag should be added to this patch?

Bart.

Re: [patch] target/iscsi: double free in lio_target_tiqn_addtpg()

[Dan Carpenter]

On Thu, Dec 15, 2016 at 04:43:55PM +0100, Bart Van Assche wrote:
> On 12/13/2016 01:27 PM, Dan Carpenter wrote:
> > This iscsit_tpg_add_portal_group() function is only called from
> > lio_target_tiqn_addtpg().  Both functions free the "tpg" pointer on
> > error so it's a double free bug.  The memory is allocated in the caller
> > so it should be freed in the caller and not here.
> > 
> > Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> Hello Dan,
> 
> Do you think a "Cc: stable" tag should be added to this patch?
> 

It will basically only fail for allocation errors.  It's probably not
super likely.  These are static checker fixes, not something I
encountered in real life.

regards,
dan carpenter

Re: [patch] target/iscsi: double free in lio_target_tiqn_addtpg()

[Bart Van Assche]

On 12/15/2016 09:31 PM, Dan Carpenter wrote:
> On Thu, Dec 15, 2016 at 04:43:55PM +0100, Bart Van Assche wrote:
>> On 12/13/2016 01:27 PM, Dan Carpenter wrote:
>>> This iscsit_tpg_add_portal_group() function is only called from
>>> lio_target_tiqn_addtpg().  Both functions free the "tpg" pointer on
>>> error so it's a double free bug.  The memory is allocated in the caller
>>> so it should be freed in the caller and not here.
>>>
>>> Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>
>> Do you think a "Cc: stable" tag should be added to this patch?
> 
> It will basically only fail for allocation errors.  It's probably not
> super likely.  These are static checker fixes, not something I
> encountered in real life.

Hello Dan,

Thanks for the patch and for the additional clarification. I have queued
your patch for kernel version v4.10.

Bart.