Skip to content

Commit

Permalink
iSCSI: do not use LUN id allocated on the stack
Browse files Browse the repository at this point in the history
The previous patch did not box the value passed over the
FFI boundary. With optimized builds the value might get
dropped before all the callbacks where executed. In effect
a use after free.
  • Loading branch information
gila committed Aug 11, 2020
1 parent d16762c commit 0470c5f
Showing 1 changed file with 5 additions and 9 deletions.
14 changes: 5 additions & 9 deletions mayastor/src/target/iscsi.rs
Original file line number Diff line number Diff line change
Expand Up @@ -190,25 +190,21 @@ pub fn fini() {
fn share_as_iscsi_target(
bdev_name: &str,
bdev: &Bdev,
pg_idx: c_int,
ig_idx: c_int,
mut pg_idx: c_int,
mut ig_idx: c_int,
) -> Result<String, Error> {
let iqn = target_name(bdev_name).into_cstring();

let pg_tags = [pg_idx].as_mut_ptr();
let ig_tags = [ig_idx].as_mut_ptr();
let lun_ids = [0].as_mut_ptr();

let tgt = unsafe {
iscsi_tgt_node_construct(
-1,
iqn.as_ptr(),
ptr::null(),
pg_tags,
ig_tags,
&mut pg_idx as *mut _,
&mut ig_idx as *mut _,
1,
&mut bdev.name().into_cstring().as_ptr(),
lun_ids,
&mut LUN as *mut _,
1,
128,
true,
Expand Down

0 comments on commit 0470c5f

Please sign in to comment.