Mark Johnston a7a7c306bf md: Fix a read-after-free in BIO_GETATTR handling
g_handleattr_int() consumes the bio if the attribute matches, so when we
check bp->bio_cmd bp may have been freed.

Move GETATTR handling to a separate function to avoid the problem.  We
do not need to set bio_completed for such bios, g_handleattr_int() will
handle it.  Also remove the setting of bio_resid before the
devstat_end_transaction_bio() call.  All of the md(4) bio handlers set
bio_resid already.

Reported by:	KASAN
Reviewed by:	kib
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D27724
2020-12-23 11:16:40 -05:00
..