iscsi-target: fix heap buffer overflow on error

If a key was larger than 64 bytes, as checked by iscsi_check_key(), the
error response packet, generated by iscsi_add_notunderstood_response(),
would still attempt to copy the entire key into the packet, overflowing
the structure on the heap.

Remote preauthentication kernel memory corruption was possible if a
target was configured and listening on the network.

CVE-2013-2850

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
void iscsi_release_param_list(struct iscsi_param_list *param_list)
{
	struct iscsi_param *param, *param_tmp;

	list_for_each_entry_safe(param, param_tmp, &param_list->param_list,
			p_list) {
		list_del(&param->p_list);

		kfree(param->name);
		kfree(param->value);
		kfree(param);
	}

	iscsi_release_extra_responses(param_list);

	kfree(param_list);
}

void iscsi_release_param_list(struct iscsi_param_list *param_list)
{
	struct iscsi_param *param, *param_tmp;

	list_for_each_entry_safe(param, param_tmp, &param_list->param_list,
			p_list) {
		list_del(&param->p_list);

		kfree(param->name);
		kfree(param->value);
		kfree(param);
	}

	iscsi_release_extra_responses(param_list);

	kfree(param_list);
}
