Page MenuHomeFreeBSD

Fix possible double free in bwn_{dma,pio}_tx_start().
ClosedPublic

Authored by markj on Nov 26 2018, 2:37 PM.
Tags
None
Referenced Files
F132345744: D18342.id51892.diff
Thu, Oct 16, 2:41 AM
Unknown Object (File)
Fri, Oct 10, 9:26 AM
Unknown Object (File)
Thu, Sep 25, 2:06 AM
Unknown Object (File)
Wed, Sep 24, 1:37 AM
Unknown Object (File)
Fri, Sep 19, 8:35 AM
Unknown Object (File)
Thu, Sep 18, 5:36 PM
Unknown Object (File)
Thu, Sep 18, 2:41 PM
Unknown Object (File)
Thu, Sep 18, 11:46 AM
Subscribers

Details

Summary

The caller of bwn_{dma,pio}_tx_start() frees the mbuf if the call fails.
The tx_start routines may call m_defrag() which frees the input mbuf
chain upon success; if the routines fail after successfully calling
m_defrag(), we will free the mbuf chain twice.

Test Plan

None; I don't have any hardware which uses this driver.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj added a reviewer: landonf.

This looks good to me; I'll try to test on real hardware over the weekend, just to be sure.

This looks good to me; I'll try to test on real hardware over the weekend, just to be sure.

Thanks!

Sorry to nag, but did you get a chance to test this?

Sorry to nag, but did you get a chance to test this?

Apologies, wasn't able to get to it until tonight; other than the small KASSERT ordering issue, everything seems to be fine on a real hardware.

  • Fix assert ordering issue.

Sorry to nag, but did you get a chance to test this?

Apologies, wasn't able to get to it until tonight; other than the small KASSERT ordering issue, everything seems to be fine on a real hardware.

Thanks. Not sure how the assert issue slipped through build testing, but the latest upload fixes it.

This revision is now accepted and ready to land.Dec 12 2018, 5:01 AM
This revision was automatically updated to reflect the committed changes.