⬢ DragonFlyBSD Kernel Audit
DF-5329 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/cam/cam_periph.c
+++ b/sys/bus/cam/cam_periph.c
@@ -350,7 +350,16 @@
 		sim = periph->sim;
 		xpt_lock_buses();
 		if ((periph->flags & CAM_PERIPH_INVALID) == 0 ||
+		    (int)periph->refcount <= 0 ||	/* DF-5329: trap underflow */
 		    periph->refcount != 1) {
+			if ((int)periph->refcount <= 0) {
+				kprintf("cam_periph_release: %s%d refcount "
+				    "underflow (%u), not releasing\n",
+				    periph->periph_name,
+				    periph->unit_number, periph->refcount);
+				xpt_unlock_buses();
+				break;
+			}
 			--periph->refcount;
 			xpt_unlock_buses();
 			break;
@@ -573,7 +582,7 @@
 	xpt_lock_buses();
 	if (periph->refcount == 0)
 		camperiphfree(periph);
-	else if (periph->refcount < 0)
+	else if ((int)periph->refcount < 0)	/* DF-5329: u_int32_t */
 		kprintf("cam_invalidate_periph: refcount < 0!!\n");
 	xpt_unlock_buses();
 }