Page MenuHomeFreeBSD

Fix possible double free in bwn_{dma,pio}_tx_start().
ClosedPublic

Authored by markj on Nov 26 2018, 2:37 PM.
Tags
None
Referenced Files
Unknown Object (File)
Feb 10 2024, 9:15 AM
Unknown Object (File)
Jan 2 2024, 9:18 AM
Unknown Object (File)
Dec 22 2023, 10:03 PM
Unknown Object (File)
Oct 9 2023, 2:35 AM
Unknown Object (File)
May 21 2023, 1:47 PM
Unknown Object (File)
May 14 2023, 12:58 AM
Unknown Object (File)
Apr 14 2023, 4:06 AM
Unknown Object (File)
Apr 1 2023, 1:03 PM
Subscribers

Details

Summary

The caller of bwn_{dma,pio}_tx_start() frees the mbuf if the call fails.
The tx_start routines may call m_defrag() which frees the input mbuf
chain upon success; if the routines fail after successfully calling
m_defrag(), we will free the mbuf chain twice.

Test Plan

None; I don't have any hardware which uses this driver.

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 21510
Build 20823: arc lint + arc unit

Event Timeline

markj added a reviewer: landonf.

This looks good to me; I'll try to test on real hardware over the weekend, just to be sure.

This looks good to me; I'll try to test on real hardware over the weekend, just to be sure.

Thanks!

Sorry to nag, but did you get a chance to test this?

Sorry to nag, but did you get a chance to test this?

Apologies, wasn't able to get to it until tonight; other than the small KASSERT ordering issue, everything seems to be fine on a real hardware.

  • Fix assert ordering issue.

Sorry to nag, but did you get a chance to test this?

Apologies, wasn't able to get to it until tonight; other than the small KASSERT ordering issue, everything seems to be fine on a real hardware.

Thanks. Not sure how the assert issue slipped through build testing, but the latest upload fixes it.

This revision is now accepted and ready to land.Dec 12 2018, 5:01 AM
This revision was automatically updated to reflect the committed changes.