git: f7a7748afc1c - stable/13 - ocs_fc: Fix a use after free in ocs_sport_free
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 17 Dec 2021 10:37:06 UTC
The branch stable/13 has been updated by ram:
URL: https://cgit.FreeBSD.org/src/commit/?id=f7a7748afc1ccec9c10a08ce86d882528a0410e3
commit f7a7748afc1ccec9c10a08ce86d882528a0410e3
Author: Ram Kishore Vegesna <ram@FreeBSD.org>
AuthorDate: 2021-05-28 05:26:13 +0000
Commit: Ram Kishore Vegesna <ram@FreeBSD.org>
CommitDate: 2021-12-17 10:12:09 +0000
ocs_fc: Fix a use after free in ocs_sport_free
Domain which could be freed is used while freeing the sport.
Use ocs from sport.
PR: 255866
Reported by: lylgood@foxmail.com
Approved by:: markj
(cherry picked from commit dd722ccd6efcaed5c6056e51a044db7f1a5b4a0d)
---
sys/dev/ocs_fc/ocs_sport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/dev/ocs_fc/ocs_sport.c b/sys/dev/ocs_fc/ocs_sport.c
index 71fe350311f7..7df31b1448f1 100644
--- a/sys/dev/ocs_fc/ocs_sport.c
+++ b/sys/dev/ocs_fc/ocs_sport.c
@@ -263,7 +263,7 @@ ocs_sport_free(ocs_sport_t *sport)
ocs_lock_free(&sport->node_group_lock);
ocs_scsi_sport_deleted(sport);
- ocs_free(domain->ocs, sport, sizeof(*sport));
+ ocs_free(sport->ocs, sport, sizeof(*sport));
}
}