The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=4cf33275289088e3b0a913a44b5cd549e348094d
commit 4cf33275289088e3b0a913a44b5cd549e348094d Author: Mark Johnston <ma...@freebsd.org> AuthorDate: 2021-05-26 14:34:39 +0000 Commit: Mark Johnston <ma...@freebsd.org> CommitDate: 2021-05-26 14:49:30 +0000 acpi: Add missing error handling to acpi_pci_link_route_irqs() Otherwise the resouce buffer may have been freed when AcpiSetCurrentResources() is called, leading to a use-after-free. PR: 255862 Submitted by: Lv Yunlong <lylg...@foxmail.com> (original version) MFC after: 1 week --- sys/dev/acpica/acpi_pci_link.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sys/dev/acpica/acpi_pci_link.c b/sys/dev/acpica/acpi_pci_link.c index ecc4f26d3fb4..3dab2807bd92 100644 --- a/sys/dev/acpica/acpi_pci_link.c +++ b/sys/dev/acpica/acpi_pci_link.c @@ -843,8 +843,10 @@ acpi_pci_link_srs_from_links(struct acpi_pci_link_softc *sc, device_printf(sc->pl_dev, "Unable to build resources: %s\n", AcpiFormatException(status)); - if (srsbuf->Pointer != NULL) + if (srsbuf->Pointer != NULL) { AcpiOsFree(srsbuf->Pointer); + srsbuf->Pointer = NULL; + } return (status); } } @@ -867,6 +869,8 @@ acpi_pci_link_route_irqs(device_t dev) status = acpi_pci_link_srs_from_links(sc, &srsbuf); else status = acpi_pci_link_srs_from_crs(sc, &srsbuf); + if (ACPI_FAILURE(status)) + return (status); /* Write out new resources via _SRS. */ status = AcpiSetCurrentResources(acpi_get_handle(dev), &srsbuf); _______________________________________________ dev-commits-src-main@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/dev-commits-src-main To unsubscribe, send any mail to "dev-commits-src-main-unsubscr...@freebsd.org"