[src/trunk]: src/sys/dev/ic Set 'ld_sync' to NULL as part of 'again', to prev...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/48a92ed685f0
branches:  trunk
changeset: 968213:48a92ed685f0
user:      maxv <maxv%NetBSD.org@localhost>
date:      Tue Jan 07 06:12:09 2020 +0000

description:
Set 'ld_sync' to NULL as part of 'again', to prevent use-after-free.

diffstat:

 sys/dev/ic/mfi.c |  7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diffs (33 lines):

diff -r 2a9f16d0d0e3 -r 48a92ed685f0 sys/dev/ic/mfi.c
--- a/sys/dev/ic/mfi.c  Tue Jan 07 06:10:18 2020 +0000
+++ b/sys/dev/ic/mfi.c  Tue Jan 07 06:12:09 2020 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: mfi.c,v 1.62 2019/11/10 21:16:35 chs Exp $ */
+/* $NetBSD: mfi.c,v 1.63 2020/01/07 06:12:09 maxv Exp $ */
 /* $OpenBSD: mfi.c,v 1.66 2006/11/28 23:59:45 dlg Exp $ */
 
 /*
@@ -73,7 +73,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mfi.c,v 1.62 2019/11/10 21:16:35 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mfi.c,v 1.63 2020/01/07 06:12:09 maxv Exp $");
 
 #include "bio.h"
 
@@ -3378,12 +3378,13 @@
        int i;
        struct mfi_ccb *ccb = NULL;
        uint8_t mbox[MFI_MBOX_SIZE];
-       struct mfi_ld *ld_sync = NULL;
+       struct mfi_ld *ld_sync;
        size_t ld_size;
        int s;
 
        DNPRINTF(MFI_D_SYNC, "%s: mfi_tbolt_sync_map_info\n", DEVNAME(sc));
 again:
+       ld_sync = NULL;
        s = splbio();
        if (sc->sc_ldsync_ccb != NULL) {
                splx(s);