From owner-svn-src-stable-10@FreeBSD.ORG Sun Dec 21 16:43:57 2014 Return-Path: Delivered-To: svn-src-stable-10@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4437A64F; Sun, 21 Dec 2014 16:43:57 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 2F9A33157; Sun, 21 Dec 2014 16:43:57 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id sBLGhvsp024172; Sun, 21 Dec 2014 16:43:57 GMT (envelope-from smh@FreeBSD.org) Received: (from smh@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id sBLGhv2k024171; Sun, 21 Dec 2014 16:43:57 GMT (envelope-from smh@FreeBSD.org) Message-Id: <201412211643.sBLGhv2k024171@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: smh set sender to smh@FreeBSD.org using -f From: Steven Hartland Date: Sun, 21 Dec 2014 16:43:57 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r276020 - stable/10/sys/dev/ahci X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-10@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for only the 10-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Dec 2014 16:43:57 -0000 Author: smh Date: Sun Dec 21 16:43:56 2014 New Revision: 276020 URL: https://svnweb.freebsd.org/changeset/base/276020 Log: MFC r272223: Prevent possible use after free in ahci direct mode Sponsored by: Multiplay Modified: stable/10/sys/dev/ahci/ahci.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/dev/ahci/ahci.c ============================================================================== --- stable/10/sys/dev/ahci/ahci.c Sun Dec 21 16:38:29 2014 (r276019) +++ stable/10/sys/dev/ahci/ahci.c Sun Dec 21 16:43:56 2014 (r276020) @@ -1580,6 +1580,7 @@ ahci_ch_intr_direct(void *arg) struct ahci_channel *ch = device_get_softc(dev); struct ccb_hdr *ccb_h; uint32_t istatus; + STAILQ_HEAD(, ccb_hdr) tmp_doneq = STAILQ_HEAD_INITIALIZER(tmp_doneq); /* Read interrupt statuses. */ istatus = ATA_INL(ch->r_mem, AHCI_P_IS); @@ -1590,9 +1591,14 @@ ahci_ch_intr_direct(void *arg) ch->batch = 1; ahci_ch_intr_main(ch, istatus); ch->batch = 0; + /* + * Prevent the possibility of issues caused by processing the queue + * while unlocked below by moving the contents to a local queue. + */ + STAILQ_CONCAT(&tmp_doneq, &ch->doneq); mtx_unlock(&ch->mtx); - while ((ccb_h = STAILQ_FIRST(&ch->doneq)) != NULL) { - STAILQ_REMOVE_HEAD(&ch->doneq, sim_links.stqe); + while ((ccb_h = STAILQ_FIRST(&tmp_doneq)) != NULL) { + STAILQ_REMOVE_HEAD(&tmp_doneq, sim_links.stqe); xpt_done_direct((union ccb *)ccb_h); } }