Author: emaste
Date: Tue Feb 7 04:03:39 2012
New Revision: 231112
URL: http://svn.freebsd.org/changeset/base/231112
Log:
MFC r227893 and r228119:
Avoid double free creating a new RAID with invalid command line
arguments.
In build_volume(), check if arrays is allocated before traversing its
items. While parsing the arrays input, it's possible that we reach the
error path before initializing the 'arrays' pointer, which in turn leads
to a NULL deference.
Modified:
stable/9/usr.sbin/mfiutil/mfi_config.c
Directory Properties:
stable/9/usr.sbin/mfiutil/ (props changed)
Modified: stable/9/usr.sbin/mfiutil/mfi_config.c
==============================================================================
--- stable/9/usr.sbin/mfiutil/mfi_config.c Tue Feb 7 04:00:57 2012
(r231111)
+++ stable/9/usr.sbin/mfiutil/mfi_config.c Tue Feb 7 04:03:39 2012
(r231112)
@@ -348,6 +348,7 @@ parse_array(int fd, int raid_type, char
error = mfi_lookup_drive(fd, cp, &device_id);
if (error) {
free(info->drives);
+ info->drives = NULL;
return (error);
}
@@ -355,12 +356,14 @@ parse_array(int fd, int raid_type, char
error = errno;
warn("Failed to fetch drive info for drive %s", cp);
free(info->drives);
+ info->drives = NULL;
return (error);
}
if (pinfo->fw_state != MFI_PD_STATE_UNCONFIGURED_GOOD) {
warnx("Drive %u is not available", device_id);
free(info->drives);
+ info->drives = NULL;
return (EINVAL);
}
}
@@ -817,9 +820,11 @@ error:
free(config);
free(state.volumes);
free(state.arrays);
- for (i = 0; i < narrays; i++)
- free(arrays[i].drives);
- free(arrays);
+ if (arrays != NULL) {
+ for (i = 0; i < narrays; i++)
+ free(arrays[i].drives);
+ free(arrays);
+ }
close(fd);
return (error);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
