Date: Wed, 2 Jun 2021 13:35:37 GMT From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 7a67b893e81e - stable/13 - cxgb: Avoid a read-after-free in get_packet() when cxgb_debug is on Message-ID: <202106021335.152DZbSF012016@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=7a67b893e81e20c2d6f4e30ef6c304838f6cc0df commit 7a67b893e81e20c2d6f4e30ef6c304838f6cc0df Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2021-05-26 14:02:19 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-06-02 13:34:07 +0000 cxgb: Avoid a read-after-free in get_packet() when cxgb_debug is on PR: 255863 MFC after: 1 week (cherry picked from commit 16f8f89c5c1f324a15a7e0607f03f041a230a572) --- sys/dev/cxgb/cxgb_sge.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/dev/cxgb/cxgb_sge.c b/sys/dev/cxgb/cxgb_sge.c index f13d2f03180c..00b67880fcc8 100644 --- a/sys/dev/cxgb/cxgb_sge.c +++ b/sys/dev/cxgb/cxgb_sge.c @@ -2773,6 +2773,7 @@ get_packet(adapter_t *adap, unsigned int drop_thres, struct sge_qset *qs, if (mh->mh_tail == NULL) { log(LOG_ERR, "discarding intermediate descriptor entry\n"); m_freem(m); + m = NULL; break; } mh->mh_tail->m_next = m; @@ -2780,7 +2781,7 @@ get_packet(adapter_t *adap, unsigned int drop_thres, struct sge_qset *qs, mh->mh_head->m_pkthdr.len += len; break; } - if (cxgb_debug) + if (cxgb_debug && m != NULL) printf("len=%d pktlen=%d\n", m->m_len, m->m_pkthdr.len); done: if (++fl->cidx == fl->size)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202106021335.152DZbSF012016>