diff options
| author | Jaeyoon Choi <jaeyoon@FreeBSD.org> | 2026-08-10 01:44:35 +0000 |
|---|---|---|
| committer | Jaeyoon Choi <jaeyoon@FreeBSD.org> | 2026-08-10 02:28:51 +0000 |
| commit | c71705a0830497c080579896b4aa2a5ce2513f1c (patch) | |
| tree | 52e024102183535b1f3126d0b26542265c0e7878 | |
| parent | 25a61a7927c8b1a516e6e095a6f53031a8636fde (diff) | |
ufshci: do not free the devq twice on SIM attach failure
cam_sim_free() with free_devq set already frees the devq, so the
following cam_simq_free() call on the xpt_bus_register() and
xpt_create_path() failure paths was a double free. Also clear
ctrlr->ufshci_sim so a later ufshci_sim_detach() does not operate on
the freed SIM.
Sponsored by: Samsung Electronics
Reviewed by: imp (mentor)
Differential Revision: https://reviews.freebsd.org/D58662
| -rw-r--r-- | sys/dev/ufshci/ufshci_sim.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/dev/ufshci/ufshci_sim.c b/sys/dev/ufshci/ufshci_sim.c index 9d80dd195ad9..4a106a6c7b8a 100644 --- a/sys/dev/ufshci/ufshci_sim.c +++ b/sys/dev/ufshci/ufshci_sim.c @@ -371,8 +371,9 @@ ufshci_sim_attach(struct ufshci_controller *ctrlr) mtx_lock(&ctrlr->sc_mtx); if (xpt_bus_register(ctrlr->ufshci_sim, ctrlr->dev, 0) != CAM_SUCCESS) { + /* cam_sim_free() with free_devq also frees the devq. */ cam_sim_free(ctrlr->ufshci_sim, /*free_devq*/ TRUE); - cam_simq_free(devq); + ctrlr->ufshci_sim = NULL; mtx_unlock(&ctrlr->sc_mtx); printf("Failed to create a bus\n"); return (ENOMEM); @@ -383,7 +384,7 @@ ufshci_sim_attach(struct ufshci_controller *ctrlr) CAM_LUN_WILDCARD) != CAM_REQ_CMP) { xpt_bus_deregister(cam_sim_path(ctrlr->ufshci_sim)); cam_sim_free(ctrlr->ufshci_sim, /*free_devq*/ TRUE); - cam_simq_free(devq); + ctrlr->ufshci_sim = NULL; mtx_unlock(&ctrlr->sc_mtx); printf("Failed to create a path\n"); return (ENOMEM); |