iscsi-target: Fix dynamic -> explict NodeACL pointer reference

This patch fixes a free after use in lio_target_make_nodeacl() where
iscsi_node_acl was referenced from the original se_nacl_new allocation,
instead of from core_tpg_add_initiator_node_acl() in the case of dynamic
-> explict NodeACL conversion.

Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index 6b35b37988edef2015df364158baad734a119e93..dcef63bf5f9da13eef0d82891c69d86b76a5ecde 100644 (file)
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -812,9 +812,6 @@ static struct se_node_acl *lio_target_make_nodeacl(
        if (!se_nacl_new)
                return ERR_PTR(-ENOMEM);
 
-       acl = container_of(se_nacl_new, struct iscsi_node_acl,
-                               se_node_acl);
-
        cmdsn_depth = ISCSI_TPG_ATTRIB(tpg)->default_cmdsn_depth;
        /*
         * se_nacl_new may be released by core_tpg_add_initiator_node_acl()
@@ -825,7 +822,8 @@ static struct se_node_acl *lio_target_make_nodeacl(
        if (IS_ERR(se_nacl))
                return se_nacl;
 
-       stats_cg = &acl->se_node_acl.acl_fabric_stat_group;
+       acl = container_of(se_nacl, struct iscsi_node_acl, se_node_acl);
+       stats_cg = &se_nacl->acl_fabric_stat_group;
 
        stats_cg->default_groups = kzalloc(sizeof(struct config_group) * 2,
                                GFP_KERNEL);