Created attachment 224929 [details]
returns error message if sli_cmd_common_nop() failed
Bug File: sys/dev/ocs_fc/ocs_hw.c
In function ocs_hw_async_call, if sli_cmd_common_nop() failed, ctx will be freed via ocs_free() at line 11,800. But the freed ctx is used in the later callee ocs_hw_command(.., ctx->cmd, ..., ctx), which is a use after free bug.
If the later callee ocs_hw_command() failed, the freed ctx is freed again via
ocs_free() at line 11,806, which is a double free bug.
My patch returns the error message if sli_cmd_common_nop() failed, to avoid the later uaf and double free bugs.
Created attachment 225301 [details]
return OCS_HW_RTN_ERROR during failure.
Thanks for reporting the issue. Made some changes to your patch to directly return failure.
Please let me know if you want me to check-in these changes.
(In reply to Ram Kishore Vegesna from comment #2)
A commit in branch main references this bug:
Author: Ram Kishore Vegesna <ram@FreeBSD.org>
AuthorDate: 2021-05-28 05:51:10 +0000
Commit: Ram Kishore Vegesna <ram@FreeBSD.org>
CommitDate: 2021-05-28 05:51:10 +0000
ocs_fc: Fix use after free bug in ocs_hw_async_call()
Freed ctx is used in the later callee ocs_hw_command(),
which is a use after free bug.
Return error if sli_cmd_common_nop() failed.
Reported by: firstname.lastname@example.org
Approved by:: markj
sys/dev/ocs_fc/ocs_hw.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)