https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295815
Bug ID: 295815
Summary: mpi3mr: potential double-free of dma_desc after
DATA_OUT copyin failure
Product: Base System
Version: 14.4-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Created attachment 271441
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=271441&action=edit
Fix mpi3mr dma_desc double free on DATA_OUT copyin failure
In sys/dev/mpi3mr/mpi3mr_app.c, mpi3mr_map_data_buffer_dma() allocates
dma_buffers->dma_desc before copying DATA_OUT payload data from userspace. If
that copyin() fails, the function frees dma_buffers->dma_desc and returns an
error, but leaves dma_buffers->dma_desc pointing at the freed allocation.
The caller, mpi3mr_app_mptcmds(), handles the mapping failure by jumping to its
common out: cleanup path. That path iterates over all dma_buffers entries and
calls free(dma_buff->dma_desc, M_MPI3MR). For the DATA_OUT buffer whose
copyin() failed, this frees the same dma_desc allocation a second time.
I could not reproduce this with stock QEMU because QEMU does not provide an
mpi3mr/SAS4116 device model, but a small logic harness that models the error
path reports one double free in the buggy path.
Set dma_buffers->dma_desc to NULL after freeing it in the copyin error branch.
--
You are receiving this mail because:
You are the assignee for the bug.
