From 862e8ad26bac0411d412c8623e9ea1461d1fde33 Mon Sep 17 00:00:00 2001 From: seanc Date: Fri, 12 Jul 2019 18:17:35 +0000 Subject: [PATCH] usr.sbin/bhyve: prevent use-after-free in virtio scsi request handling Coverity CID: 1393377 Approved by: araujo, jhb Differential Revision: https://reviews.freebsd.org/D20915 --- usr.sbin/bhyve/pci_virtio_scsi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/usr.sbin/bhyve/pci_virtio_scsi.c b/usr.sbin/bhyve/pci_virtio_scsi.c index 9d9fa822e01..632f9202931 100644 --- a/usr.sbin/bhyve/pci_virtio_scsi.c +++ b/usr.sbin/bhyve/pci_virtio_scsi.c @@ -465,7 +465,7 @@ pci_vtscsi_request_handle(struct pci_vtscsi_queue *q, struct iovec *iov_in, int data_niov_in, data_niov_out; void *ext_data_ptr = NULL; uint32_t ext_data_len = 0, ext_sg_entries = 0; - int err; + int err, nxferred; seek_iov(iov_in, niov_in, data_iov_in, &data_niov_in, VTSCSI_IN_HEADER_LEN(sc)); @@ -544,10 +544,11 @@ pci_vtscsi_request_handle(struct pci_vtscsi_queue *q, struct iovec *iov_in, } buf_to_iov(cmd_wr, VTSCSI_OUT_HEADER_LEN(sc), iov_out, niov_out, 0); + nxferred = VTSCSI_OUT_HEADER_LEN(sc) + io->scsiio.ext_data_filled; free(cmd_rd); free(cmd_wr); ctl_scsi_free_io(io); - return (VTSCSI_OUT_HEADER_LEN(sc) + io->scsiio.ext_data_filled); + return (nxferred); } static void -- 2.45.0