3578ddba1a
When we create an explicit node ACL in tcm_qla2xxx_make_nodeacl(), there is a call to tcm_qla2xxx_setup_nacl_from_rport(), which puts the node ACL into the lport_fcport_map even though there is no session yet for the initiator. Since the only time we remove entries from this map is when we free a session, this means that if we later delete this node ACL without the initiator ever creating a session, we'll leave the nacl pointer in the btree pointing at freed memory. This is especially bad if that initiator later does send us a command that would cause us to create a dynamic ACL and session: we'll find the stale freed nacl pointer in the btree and end up with use-after-free. We could add more code to clear the btree entry when deleting the explicit nacl, but the original insertion is pointless: without a session attached, we'll just have to update the entry when a session appears anyway. So we can just delete tcm_qla2xxx_setup_nacl_from_rport() and the code that calls it. Signed-off-by: Roland Dreier <roland@purestorage.com> Cc: Chad Dupuis <chad.dupuis@qlogic.com> Cc: Giridhar Malavali <giridhar.malavali@qlogic.com> Cc: Arun Easi <arun.easi@qlogic.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org> |
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
qla_attr.c | ||
qla_bsg.c | ||
qla_bsg.h | ||
qla_dbg.c | ||
qla_dbg.h | ||
qla_def.h | ||
qla_devtbl.h | ||
qla_dfs.c | ||
qla_fw.h | ||
qla_gbl.h | ||
qla_gs.c | ||
qla_init.c | ||
qla_inline.h | ||
qla_iocb.c | ||
qla_isr.c | ||
qla_mbx.c | ||
qla_mid.c | ||
qla_nx.c | ||
qla_nx.h | ||
qla_os.c | ||
qla_settings.h | ||
qla_sup.c | ||
qla_target.c | ||
qla_target.h | ||
qla_version.h | ||
tcm_qla2xxx.c | ||
tcm_qla2xxx.h |