DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2302

NULL pointer dereference in fwohci_db_free when bus_dmamap_create fails partway through initialization

Summary

In fwohci_db_init if bus_dmamap_create fails on iteration K of ndb-entry loop fwohci_db_free called to clean up. But fwohci_db_free loop iterates ndb times over STAILQ that only has K entries. After K iterations STAILQ_NEXT returns NULL but idb<ndb still true so body dereferences db_tr->buf and db_tr->dma_map with db_tr==NULL -> kernel panic. Circular link only established AFTER loop completes. Trigger: memory pressure during controller init or iso channel setup.

Discussion (0)

No comments yet.