Date: Mon, 22 Jun 2026 00:41:10 +0000 From: Adrian Chadd <adrian@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Abdelkader Boudih <freebsd@seuros.com> Subject: git: 51f4e90ce7ef - main - firewire: NULL check on malloc in fw_busreset() Message-ID: <6a3884a6.39f92.2fe2b69f@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by adrian: URL: https://cgit.FreeBSD.org/src/commit/?id=51f4e90ce7ef3b8d036a9d34ab464f4152ca4bab commit 51f4e90ce7ef3b8d036a9d34ab464f4152ca4bab Author: Abdelkader Boudih <freebsd@seuros.com> AuthorDate: 2026-06-22 00:30:53 +0000 Commit: Adrian Chadd <adrian@FreeBSD.org> CommitDate: 2026-06-22 00:31:12 +0000 firewire: NULL check on malloc in fw_busreset() fw_busreset() allocates newrom with M_NOWAIT from interrupt context. If the allocation fails, crom_load() dereferences a NULL pointer. Skip the config ROM comparison on allocation failure so the next bus reset will retry. Reviewed by: adrian Differential Revision: https://reviews.freebsd.org/D57728 --- sys/dev/firewire/firewire.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sys/dev/firewire/firewire.c b/sys/dev/firewire/firewire.c index a54cbf9cdf0b..dfb906ba34c1 100644 --- a/sys/dev/firewire/firewire.c +++ b/sys/dev/firewire/firewire.c @@ -748,6 +748,8 @@ fw_busreset(struct firewire_comm *fc, uint32_t new_status) */ #define FW_MAX_GENERATION 0xF newrom = malloc(CROMSIZE, M_FW, M_NOWAIT | M_ZERO); + if (newrom == NULL) + goto out; src = &fc->crom_src_buf->src; crom_load(src, newrom, CROMSIZE); if (bcmp(newrom, fc->config_rom, CROMSIZE) != 0) { @@ -763,6 +765,7 @@ fw_busreset(struct firewire_comm *fc, uint32_t new_status) bcopy(newrom, fc->config_rom, CROMSIZE); } free(newrom, M_FW); +out:; } /* Call once after reboot */home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a3884a6.39f92.2fe2b69f>