From a6f9f870b32c9c26311a718289fbeb89ea39801e Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Wed, 17 Jun 2015 00:00:40 +0000 Subject: [PATCH] scst_lib: Fix a use-after-free in an error path scst_free_tgt_dev() frees the memory tgt_dev points at which means that list_for_each_entry_safe() is needed here. git-svn-id: http://svn.code.sf.net/p/scst/svn/trunk@6356 d57e44dd-8a1f-0410-8b47-8ef2f437770f --- scst/src/scst_lib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scst/src/scst_lib.c b/scst/src/scst_lib.c index 87efc4dc6..37e242f8f 100644 --- a/scst/src/scst_lib.c +++ b/scst/src/scst_lib.c @@ -4167,7 +4167,7 @@ int scst_acg_add_lun(struct scst_acg *acg, struct kobject *parent, { int res; struct scst_acg_dev *acg_dev; - struct scst_tgt_dev *tgt_dev; + struct scst_tgt_dev *tgt_dev, *tt; struct scst_session *sess; LIST_HEAD(tmp_tgt_dev_list); @@ -4229,7 +4229,7 @@ out: return res; out_free: - list_for_each_entry(tgt_dev, &tmp_tgt_dev_list, + list_for_each_entry_safe(tgt_dev, tt, &tmp_tgt_dev_list, extra_tgt_dev_list_entry) { scst_free_tgt_dev(tgt_dev); }