⬢ DragonFlyBSD Kernel Audit
DF-3708 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/raid/arcmsr/arcmsr.c
+++ b/sys/dev/raid/arcmsr/arcmsr.c
@@ -3054,7 +3054,9 @@
 					|| (pccb->ccb_h.flags & CAM_DATA_PHYS) != 0) {
 						pccb->ccb_h.status |= CAM_PROVIDE_FAIL;
 						xpt_done(pccb);
-						kfree(srb, M_DEVBUF);
+						/* the srb belongs to the bus_dmamem SRB pool:
+					 * recycle it, never kfree() a pool pointer */
+					arcmsr_free_srb(srb);
 						return;
 					}
 					segs=(struct bus_dma_segment *)pccb->csio.data_ptr;