iscsi-target: Fix dynamic -> explict NodeACL pointer reference

commit d06283341aee9e48eff1b068779d340785c635ce upstream.

This patch fixes a free after use in lio_target_make_nodeacl() where
iscsi_node_acl was referenced from the original se_nacl_new allocation,
instead of from core_tpg_add_initiator_node_acl() in the case of dynamic
-> explict NodeACL conversion.

Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index db327845e46b46fc04d6f2be7a21d68d9aa53d53..83dcf4939fa429ca3d90c9b867db5133b0992f90 100644 (file)
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -816,9 +816,6 @@ static struct se_node_acl *lio_target_make_nodeacl(
        if (!se_nacl_new)
                return ERR_PTR(-ENOMEM);
 
-       acl = container_of(se_nacl_new, struct iscsi_node_acl,
-                               se_node_acl);
-
        cmdsn_depth = ISCSI_TPG_ATTRIB(tpg)->default_cmdsn_depth;
        /*
         * se_nacl_new may be released by core_tpg_add_initiator_node_acl()
@@ -829,7 +826,8 @@ static struct se_node_acl *lio_target_make_nodeacl(
        if (IS_ERR(se_nacl))
                return se_nacl;
 
-       stats_cg = &acl->se_node_acl.acl_fabric_stat_group;
+       acl = container_of(se_nacl, struct iscsi_node_acl, se_node_acl);
+       stats_cg = &se_nacl->acl_fabric_stat_group;
 
        stats_cg->default_groups = kzalloc(sizeof(struct config_group) * 2,
                                GFP_KERNEL);