summaryrefslogtreecommitdiff
path: root/drivers/target/sbp
diff options
context:
space:
mode:
authorChris Boot <bootc@bootc.net>2012-12-11 21:58:48 +0000
committerNicholas Bellinger <nab@linux-iscsi.org>2012-12-12 21:17:25 -0800
commite1fe2060d7e8f58a69374135e32e90f0bb79a7fd (patch)
tree496e995322db60717dbf31ca84f9d8753f125479 /drivers/target/sbp
parent37419d674ca99739dbee5ada28b50aacc29c94e1 (diff)
sbp-target: fix error path in sbp_make_tpg()
If the TPG memory is allocated successfully, but we fail further along in the function, a dangling pointer to freed memory is left in the TPort structure. This is mostly harmless, but does prevent re-trying the operation without first removing the TPort altogether. Reported-by: Chen Gang <gang.chen@asianux.com> Signed-off-by: Chris Boot <bootc@bootc.net> Cc: Andy Grover <agrover@redhat.com> Cc: Nicholas A. Bellinger <nab@linux-iscsi.org> Cc: stable@vger.kernel.org Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/target/sbp')
-rw-r--r--drivers/target/sbp/sbp_target.c17
1 files changed, 10 insertions, 7 deletions
diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
index f0a2a1d982a2..2e8d06f198ae 100644
--- a/drivers/target/sbp/sbp_target.c
+++ b/drivers/target/sbp/sbp_target.c
@@ -2208,20 +2208,23 @@ static struct se_portal_group *sbp_make_tpg(
tport->mgt_agt = sbp_management_agent_register(tport);
if (IS_ERR(tport->mgt_agt)) {
ret = PTR_ERR(tport->mgt_agt);
- kfree(tpg);
- return ERR_PTR(ret);
+ goto out_free_tpg;
}
ret = core_tpg_register(&sbp_fabric_configfs->tf_ops, wwn,
&tpg->se_tpg, (void *)tpg,
TRANSPORT_TPG_TYPE_NORMAL);
- if (ret < 0) {
- sbp_management_agent_unregister(tport->mgt_agt);
- kfree(tpg);
- return ERR_PTR(ret);
- }
+ if (ret < 0)
+ goto out_unreg_mgt_agt;
return &tpg->se_tpg;
+
+out_unreg_mgt_agt:
+ sbp_management_agent_unregister(tport->mgt_agt);
+out_free_tpg:
+ tport->tpg = NULL;
+ kfree(tpg);
+ return ERR_PTR(ret);
}
static void sbp_drop_tpg(struct se_portal_group *se_tpg)