https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255868
Bug ID: 255868
Summary: [PATCH] dev/qlnx/qlnxe: Fix a use after free in
ecore_spq_post
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Many People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
Created attachment 224932
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=224932&action=edit
change *p_ent to **p_ent in ecore_spq_add_entry()
Bug File: sys/dev/qlnx/qlnxe/ecore_spq.c
In function ecore_spq_post, p_ent could be freed via
ecore_spq_add_entry(..,p_ent,..)->OSAL_FREE(..,p_ent).
At the spq_post_fail brach, the freed p_ent is still used by
__ecore_spq_return_entry(p_hwfn, p_ent), which is a use after free bug.
The root of this uaf bug is that, p_ent is freed in function
ecore_spq_add_entry() but failed to be reset to p_en2 by "p_ent = p_en2;". The
p_ent passed to ecore_spq_add_entry() should be **p_ent, instead of *p_ent.
My patch fixs that error by a new variable p_en1.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
