Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 1 Mar 2017 00:13:58 +0000 (UTC)
From:      Alan Somers <asomers@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r314440 - stable/10/sys/dev/mpr
Message-ID:  <201703010013.v210Dwxu019108@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: asomers
Date: Wed Mar  1 00:13:58 2017
New Revision: 314440
URL: https://svnweb.freebsd.org/changeset/base/314440

Log:
  MFC r312995:
  
  Initialize a stack variable in mprsas_get_sas_address_for_sata_disk
  
  Thought it's difficult to reproduce, I think this variable was responsible
  for a use-after-free panic when a SATA disk timed out responding to a SATA
  identify command during boot.
  
  Submitted by:	slm
  Reviewed by:	slm
  MFC after:	4 weeks
  Sponsored by:	Spectra Logic Corp
  Differential Revision:	https://reviews.freebsd.org/D9364

Modified:
  stable/10/sys/dev/mpr/mpr_sas_lsi.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/mpr/mpr_sas_lsi.c
==============================================================================
--- stable/10/sys/dev/mpr/mpr_sas_lsi.c	Tue Feb 28 23:56:24 2017	(r314439)
+++ stable/10/sys/dev/mpr/mpr_sas_lsi.c	Wed Mar  1 00:13:58 2017	(r314440)
@@ -893,6 +893,7 @@ mprsas_get_sas_address_for_sata_disk(str
 	u8 sas_status;
 
 	memset(&ata_identify, 0, sizeof(ata_identify));
+	memset(&mpi_reply, 0, sizeof(mpi_reply));
 	try_count = 0;
 	do {
 		rc = mprsas_get_sata_identify(sc, handle, &mpi_reply,



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703010013.v210Dwxu019108>