HomeFreeBSD

md: Fix a read-after-free in BIO_GETATTR handling

Description

md: Fix a read-after-free in BIO_GETATTR handling

g_handleattr_int() consumes the bio if the attribute matches, so when we
check bp->bio_cmd bp may have been freed.

Move GETATTR handling to a separate function to avoid the problem. We
do not need to set bio_completed for such bios, g_handleattr_int() will
handle it. Also remove the setting of bio_resid before the
devstat_end_transaction_bio() call. All of the md(4) bio handlers set
bio_resid already.

Reported by: KASAN
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D27724

Details

Provenance
markjAuthored on Dec 23 2020, 4:13 PM
Parents
rGace3d9475cee: ffs: Avoid out-of-bounds accesses in the fs_active bitmap
Branches
Unknown
Tags
Unknown