c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2025-01-12 19:20:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix use-after-free bugs in icp code

Browse Source 
These were reported by Coverity as "Read from pointer after free" bugs.
Presumably, it did not report it as a use-after-free bug because it does
not understand the inline assembly that implements the atomic
instruction.

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu>
Closes #13881
This commit is contained in:
Richard Yao 2022-09-15 14:46:42 -04:00 committed by GitHub
parent 6f8602a5ed
commit fd8c3012b3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
module/icp/core/kcf_mech_tabs.c
View File

@ -342,8 +342,8 @@ kcf_remove_mech_provider(const char *mech_name, kcf_provider_desc_t *prov_desc)
mech_entry->me_sw_prov = NULL; mech_entry->me_sw_prov = NULL;
/* free entry */ /* free entry */
KCF_PROV_REFRELE(prov_mech->pm_prov_desc);
KCF_PROV_IREFRELE(prov_mech->pm_prov_desc); KCF_PROV_IREFRELE(prov_mech->pm_prov_desc);
KCF_PROV_REFRELE(prov_mech->pm_prov_desc);
kmem_free(prov_mech, sizeof (kcf_prov_mech_desc_t)); kmem_free(prov_mech, sizeof (kcf_prov_mech_desc_t));
} }

2
module/icp/core/kcf_prov_tabs.c
View File

@ -158,8 +158,8 @@ kcf_prov_tab_rem_provider(crypto_provider_id_t prov_id)
* at that time. * at that time.
*/ */
KCF_PROV_REFRELE(prov_desc);
KCF_PROV_IREFRELE(prov_desc); KCF_PROV_IREFRELE(prov_desc);
KCF_PROV_REFRELE(prov_desc);
return (CRYPTO_SUCCESS); return (CRYPTO_SUCCESS);
} }