diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-05-26 14:02:19 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-06-02 13:36:35 +0000 |
| commit | d88bd7d80ff2a318aa6dc3c710538f5ddc5a1a63 (patch) | |
| tree | c7635f7b1fe9c2ec216705d6e91d96630ec9aa53 | |
| parent | a53f3a29bf6d3af7cbddaf97b04b05cac7e923a6 (diff) | |
cxgb: Avoid a read-after-free in get_packet() when cxgb_debug is on
PR: 255863
MFC after: 1 week
(cherry picked from commit 16f8f89c5c1f324a15a7e0607f03f041a230a572)
| -rw-r--r-- | sys/dev/cxgb/cxgb_sge.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/dev/cxgb/cxgb_sge.c b/sys/dev/cxgb/cxgb_sge.c index 07eb91a4d04c..5c5d1f902f30 100644 --- a/sys/dev/cxgb/cxgb_sge.c +++ b/sys/dev/cxgb/cxgb_sge.c @@ -2778,6 +2778,7 @@ get_packet(adapter_t *adap, unsigned int drop_thres, struct sge_qset *qs, if (mh->mh_tail == NULL) { log(LOG_ERR, "discarding intermediate descriptor entry\n"); m_freem(m); + m = NULL; break; } mh->mh_tail->m_next = m; @@ -2785,7 +2786,7 @@ get_packet(adapter_t *adap, unsigned int drop_thres, struct sge_qset *qs, mh->mh_head->m_pkthdr.len += len; break; } - if (cxgb_debug) + if (cxgb_debug && m != NULL) printf("len=%d pktlen=%d\n", m->m_len, m->m_pkthdr.len); done: if (++fl->cidx == fl->size) |