mirror of
https://github.com/torvalds/linux.git
synced 2025-11-07 03:59:22 +02:00
The ib_isert module is releasing the isert connection both in
isert_wait_conn() handler as well as isert_free_conn() handler.
In isert_wait_conn() handler, it is expected to wait for iSCSI
session logout operation to complete. It should free the isert
connection only in isert_free_conn() handler.
When a bunch of iSER target is cleared, this issue can lead to
use-after-free memory issue as isert conn is twice released
Fixes:
|
||
|---|---|---|
| .. | ||
| ib_isert.c | ||
| ib_isert.h | ||
| Kconfig | ||
| Makefile | ||