DragonFlyBSD Kernel Audit
DF-1233 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/raid/aac/aac.c b/sys/dev/raid/aac/aac.c
--- a/sys/dev/raid/aac/aac.c
+++ b/sys/dev/raid/aac/aac.c
@@ -3464,7 +3464,7 @@
 	}
 
 	/* evaluate unique value */
-	fibctx->unique = (*(u_int32_t *)&fibctx & 0xffffffff);
+	static volatile u_int32_t aac_aif_counter = 0; fibctx->unique = atomic_fetchadd_int(&aac_aif_counter, 1);
 	ctx = sc->fibctx;
 	while (ctx != fibctx) {
 		if (ctx->unique == fibctx->unique) {
@@ -3496,7 +3496,7 @@
 	for (ctx = sc->fibctx; ctx; ctx = ctx->next) {
 		if (ctx->unique == *(uint32_t *)&arg) {
 			if (ctx == sc->fibctx)
-				sc->fibctx = NULL;
+				sc->fibctx = ctx->next;
 			else {
 				ctx->prev->next = ctx->next;
 				if (ctx->next)