DF-2302
NULL pointer dereference in fwohci_db_free when bus_dmamap_create fails partway through initialization
Summary
In fwohci_db_init if bus_dmamap_create fails on iteration K of ndb-entry loop fwohci_db_free called to clean up. But fwohci_db_free loop iterates ndb times over STAILQ that only has K entries. After K iterations STAILQ_NEXT returns NULL but idb<ndb still true so body dereferences db_tr->buf and db_tr->dma_map with db_tr==NULL -> kernel panic. Circular link only established AFTER loop completes. Trigger: memory pressure during controller init or iso channel setup.
No comments yet.