upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 08:43:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

bhnd: Fix a few use after frees when releasing resources

Browse source 
The resource list entry needs to be looked up using rman_get_* prior
to releasing the resource.

Fixes:		9dbf5b0e68 new-bus: Remove the 'rid' and 'type' arguments from BUS_RELEASE_RESOURCE
This commit is contained in:
Gavin Atkinson 2024-12-27 11:55:05 -05:00 committed by John Baldwin
parent 2e09cef8dc
commit 6ea1ce222c
2 changed files with 13 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
sys/dev/bhnd/bhndb/bhndb.c
View file

@ -1037,7 +1037,7 @@ static int
bhndb_release_resource(device_t dev, device_t child, struct resource *r)
{
struct bhndb_softc *sc;
struct resource_list_entry *rle;
struct resource_list_entry *rle = NULL;
bool passthrough;
int error;
@ -1058,16 +1058,17 @@ bhndb_release_resource(device_t dev, device_t child, struct resource *r)
return (error);
}
/* Check for resource list entry */
if (!passthrough)
rle = resource_list_find(BUS_GET_RESOURCE_LIST(dev, child),
rman_get_type(r), rman_get_rid(r));
if ((error = rman_release_resource(r)))
return (error);
if (!passthrough) {
/* Clean resource list entry */
rle = resource_list_find(BUS_GET_RESOURCE_LIST(dev, child),
rman_get_type(r), rman_get_rid(r));
if (rle != NULL)
rle->res = NULL;
}
/* Clean resource list entry */
if (rle != NULL)
rle->res = NULL;
return (0);
}

6
sys/dev/bhnd/cores/chipc/chipc.c
View file

@ -893,6 +893,10 @@ chipc_release_resource(device_t dev, device_t child, struct resource *r)
if (cr == NULL)
return (EINVAL);
/* Cache rle */
rle = resource_list_find(BUS_GET_RESOURCE_LIST(dev, child),
rman_get_type(r), rman_get_rid(r));
/* Deactivate resources */
error = bus_generic_rman_release_resource(dev, child, r);
if (error != 0)
@ -902,8 +906,6 @@ chipc_release_resource(device_t dev, device_t child, struct resource *r)
chipc_release_region(sc, cr, RF_ALLOCATED);
/* Clear reference from the resource list entry if exists */
rle = resource_list_find(BUS_GET_RESOURCE_LIST(dev, child),
rman_get_type(r), rman_get_rid(r));
if (rle != NULL)
rle->res = NULL;