diff options
| author | Alexander Motin <mav@FreeBSD.org> | 2014-07-08 16:56:21 +0000 |
|---|---|---|
| committer | Alexander Motin <mav@FreeBSD.org> | 2014-07-08 16:56:21 +0000 |
| commit | ad3cd840f258904f327d40169f8f3c9647dd4dab (patch) | |
| tree | b697178ceef7aed38ab8058a32ac7ce0f5f1bcbb /sys/cam/ctl/ctl_frontend_cam_sim.c | |
| parent | b33b96e352c8b9e9aeb869619d0511671d498529 (diff) | |
| download | src-ad3cd840f258904f327d40169f8f3c9647dd4dab.tar.gz src-ad3cd840f258904f327d40169f8f3c9647dd4dab.zip | |
Fix use-after-free on XPT_RESET_BUS.
That command is not queued, so does not use later status update.
Notes
Notes:
svn path=/head/; revision=268419
Diffstat (limited to 'sys/cam/ctl/ctl_frontend_cam_sim.c')
| -rw-r--r-- | sys/cam/ctl/ctl_frontend_cam_sim.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sys/cam/ctl/ctl_frontend_cam_sim.c b/sys/cam/ctl/ctl_frontend_cam_sim.c index 0e454014b60b..72f8dd81c8b4 100644 --- a/sys/cam/ctl/ctl_frontend_cam_sim.c +++ b/sys/cam/ctl/ctl_frontend_cam_sim.c @@ -460,6 +460,10 @@ cfcs_done(union ctl_io *io) union ccb *ccb; ccb = io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr; + if (ccb == NULL) { + ctl_free_io(io); + return; + } /* * At this point we should have status. If we don't, that's a bug. @@ -741,7 +745,8 @@ cfcs_action(struct cam_sim *sim, union ccb *ccb) ctl_zero_io(io); /* Save pointers on both sides */ - io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = ccb; + if (ccb->ccb_h.func_code == XPT_RESET_DEV) + io->io_hdr.ctl_private[CTL_PRIV_FRONTEND].ptr = ccb; ccb->ccb_h.io_ptr = io; io->io_hdr.io_type = CTL_IO_TASK; |