Date: Sun, 18 Jun 2017 17:37:15 +0800 From: Jia-Ju Bai <baijiaju1990@163.com> Cc: freebsd-drivers@freebsd.org, freebsd-scsi@freebsd.org, Jia-Ju Bai <baijiaju1990@163.com> Subject: [Bug 220094][PATCH] scsi_sa: Fix a possible sleep-under-mutex bug in saioctl Message-ID: <20170618093715.40555-1-baijiaju1990@163.com>
next in thread | raw e-mail | index | archive | help
The driver may sleep under a mutex, and the function call path is:
saioctl [acquire the mutex]
saextget
malloc(M_WAITOK) --> may sleep
The possible fix of this bug is to replace "M_WAITOK" in malloc with
"M_NOWAIT".
This bug is found by a static analysis tool written by myself, and it is
checked by my review of the FreeBSD code.
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
---
sys/cam/scsi/scsi_sa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/cam/scsi/scsi_sa.c b/sys/cam/scsi/scsi_sa.c
index 8a8451c3bce..b884bd3d65f 100644
--- a/sys/cam/scsi/scsi_sa.c
+++ b/sys/cam/scsi/scsi_sa.c
@@ -4465,7 +4465,7 @@ saextget(struct cdev *dev, struct cam_periph *periph, struct sbuf *sb,
if (cgd.serial_num_len > sizeof(tmpstr)) {
ts2_len = cgd.serial_num_len + 1;
ts2_malloc = 1;
- tmpstr2 = malloc(ts2_len, M_SCSISA, M_WAITOK | M_ZERO);
+ tmpstr2 = malloc(ts2_len, M_SCSISA, M_NOWAIT | M_ZERO);
} else {
ts2_len = sizeof(tmpstr);
ts2_malloc = 0;
--
2.13.0
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20170618093715.40555-1-baijiaju1990>