d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix possible use of invalid pointer.

Browse Source 
It was possible to use an invalid pointer to get the target ID value. To fix
this, initialize a local Target ID variable to an invalid value and change that
variable to a valid value only if the pointer to the Target ID is not NULL.

Reviewed by:    ken, scottl, ambrisko, asomers
Approved by:	ken, scottl, ambrisko
MFC after:      1 week
Differential Revision: https://reviews.freebsd.org/D6100
This commit is contained in:
Stephen McConnell 2016-05-09 16:26:34 +00:00
parent b41c6ff97a
commit 8861939221
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/dev/mpr/mpr_sas.c
View File

@ -243,6 +243,8 @@ mprsas_alloc_tm(struct mpr_softc *sc)
void
mprsas_free_tm(struct mpr_softc *sc, struct mpr_command *tm)
{
int target_id = 0xFFFFFFFF;
MPR_FUNCTRACE(sc);
if (tm == NULL)
return;
@ -254,10 +256,11 @@ mprsas_free_tm(struct mpr_softc *sc, struct mpr_command *tm)
*/
if (tm->cm_targ != NULL) {
tm->cm_targ->flags &= ~MPRSAS_TARGET_INRESET;
target_id = tm->cm_targ->tid;
}
if (tm->cm_ccb) {
mpr_dprint(sc, MPR_INFO, "Unfreezing devq for target ID %d\n",
tm->cm_targ->tid);
target_id);
xpt_release_devq(tm->cm_ccb->ccb_h.path, 1, TRUE);
xpt_free_path(tm->cm_ccb->ccb_h.path);
xpt_free_ccb(tm->cm_ccb);