Author: truckman
Date: Fri May 13 06:26:42 2016
New Revision: 299592
URL: https://svnweb.freebsd.org/changeset/base/299592
Log:
Move a call to cam_freeccb() to avoid a use after free error and
a later double free.
Reported by: Coverity
CID: 1018507
MFC after: 1 week
Modified:
head/usr.sbin/mptutil/mpt_cam.c
Modified: head/usr.sbin/mptutil/mpt_cam.c
==============================================================================
--- head/usr.sbin/mptutil/mpt_cam.c Fri May 13 06:15:05 2016
(r299591)
+++ head/usr.sbin/mptutil/mpt_cam.c Fri May 13 06:26:42 2016
(r299592)
@@ -260,7 +260,6 @@ fetch_scsi_capacity(struct cam_device *d
cam_freeccb(ccb);
return (EIO);
}
- cam_freeccb(ccb);
/*
* A last block of 2^32-1 means that the true capacity is over 2TB,
@@ -269,6 +268,7 @@ fetch_scsi_capacity(struct cam_device *d
*/
if (scsi_4btoul(rcap.addr) != 0xffffffff) {
disk->maxlba = scsi_4btoul(rcap.addr);
+ cam_freeccb(ccb);
return (0);
}
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
