From owner-svn-src-stable-11@freebsd.org Thu Jun 14 17:02:59 2018
Return-Path: <owner-svn-src-stable-11@freebsd.org>
Delivered-To: svn-src-stable-11@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mailman.ysv.freebsd.org (Postfix) with ESMTP id 292DB1014532;
Thu, 14 Jun 2018 17:02:59 +0000 (UTC) (envelope-from mav@FreeBSD.org)
Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org
[IPv6:2610:1c1:1:606c::19:3])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client CN "mxrelay.nyi.freebsd.org",
Issuer "Let's Encrypt Authority X3" (verified OK))
by mx1.freebsd.org (Postfix) with ESMTPS id D065374C70;
Thu, 14 Jun 2018 17:02:58 +0000 (UTC) (envelope-from mav@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
[IPv6:2610:1c1:1:6068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client did not present a certificate)
by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B1D8F33F0;
Thu, 14 Jun 2018 17:02:58 +0000 (UTC) (envelope-from mav@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w5EH2wNH087273;
Thu, 14 Jun 2018 17:02:58 GMT (envelope-from mav@FreeBSD.org)
Received: (from mav@localhost)
by repo.freebsd.org (8.15.2/8.15.2/Submit) id w5EH2whq087272;
Thu, 14 Jun 2018 17:02:58 GMT (envelope-from mav@FreeBSD.org)
Message-Id: <201806141702.w5EH2whq087272@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: mav set sender to mav@FreeBSD.org
using -f
From: Alexander Motin <mav@FreeBSD.org>
Date: Thu, 14 Jun 2018 17:02:58 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject: svn commit: r335152 - stable/11/sys/dev/nvme
X-SVN-Group: stable-11
X-SVN-Commit-Author: mav
X-SVN-Commit-Paths: stable/11/sys/dev/nvme
X-SVN-Commit-Revision: 335152
X-SVN-Commit-Repository: base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-stable-11@freebsd.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: SVN commit messages for only the 11-stable src tree
<svn-src-stable-11.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-stable-11>,
<mailto:svn-src-stable-11-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-stable-11/>
List-Post: <mailto:svn-src-stable-11@freebsd.org>
List-Help: <mailto:svn-src-stable-11-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-stable-11>,
<mailto:svn-src-stable-11-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Jun 2018 17:02:59 -0000
Author: mav
Date: Thu Jun 14 17:02:58 2018
New Revision: 335152
URL: https://svnweb.freebsd.org/changeset/base/335152
Log:
MFC r333127: Fix use-after-free in nvme_qpair_destroy().
dma_tag_payload should not be destroyed before payload_dma_map, and seems
it should be used there instead of dma_tag to match creation.
Modified:
stable/11/sys/dev/nvme/nvme_qpair.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/dev/nvme/nvme_qpair.c
==============================================================================
--- stable/11/sys/dev/nvme/nvme_qpair.c Thu Jun 14 16:58:03 2018 (r335151)
+++ stable/11/sys/dev/nvme/nvme_qpair.c Thu Jun 14 17:02:58 2018 (r335152)
@@ -606,21 +606,22 @@ nvme_qpair_destroy(struct nvme_qpair *qpair)
qpair->queuemem_map);
}
- if (qpair->dma_tag)
- bus_dma_tag_destroy(qpair->dma_tag);
-
- if (qpair->dma_tag_payload)
- bus_dma_tag_destroy(qpair->dma_tag_payload);
-
if (qpair->act_tr)
free(qpair->act_tr, M_NVME);
while (!TAILQ_EMPTY(&qpair->free_tr)) {
tr = TAILQ_FIRST(&qpair->free_tr);
TAILQ_REMOVE(&qpair->free_tr, tr, tailq);
- bus_dmamap_destroy(qpair->dma_tag, tr->payload_dma_map);
+ bus_dmamap_destroy(qpair->dma_tag_payload,
+ tr->payload_dma_map);
free(tr, M_NVME);
}
+
+ if (qpair->dma_tag)
+ bus_dma_tag_destroy(qpair->dma_tag);
+
+ if (qpair->dma_tag_payload)
+ bus_dma_tag_destroy(qpair->dma_tag_payload);
}
static void