diff options
| author | sephe <sephe@FreeBSD.org> | 2016-06-13 05:13:52 +0000 |
|---|---|---|
| committer | sephe <sephe@FreeBSD.org> | 2016-06-13 05:13:52 +0000 |
| commit | e09e20d157b05b8e4a7a3bb7b2dab5097fd346a9 (patch) | |
| tree | 996ab5244b89f4587583ffcb82ad7f3798117af3 | |
| parent | 68351381b4d267fc885d59efa33e4c3616810660 (diff) | |
| download | FreeBSD-src-e09e20d157b05b8e4a7a3bb7b2dab5097fd346a9.zip FreeBSD-src-e09e20d157b05b8e4a7a3bb7b2dab5097fd346a9.tar.gz | |
MFC 295295
hyperv/stor: Fix the NULL pointer dereference
Reported by: Netapp
Submitted by: Hongjiang Zhang <honzhan microsoft com>
Reviewed by: adrian, sephe, Dexuan Cui <decui microsoft com>
Approved by: adrian (mentor)
MFC after: 1 week
Sponsored by: Microsoft OSTC
Differential Revision: https://reviews.freebsd.org/D5097
| -rw-r--r-- | sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c b/sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c index a780f9e..dd2f00d 100644 --- a/sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c +++ b/sys/dev/hyperv/storvsc/hv_storvsc_drv_freebsd.c @@ -1561,13 +1561,12 @@ static void storvsc_destroy_bounce_buffer(struct sglist *sgl) { struct hv_sgl_node *sgl_node = NULL; - - sgl_node = LIST_FIRST(&g_hv_sgl_page_pool.in_use_sgl_list); - LIST_REMOVE(sgl_node, link); - if (NULL == sgl_node) { + if (LIST_EMPTY(&g_hv_sgl_page_pool.in_use_sgl_list)) { printf("storvsc error: not enough in use sgl\n"); return; } + sgl_node = LIST_FIRST(&g_hv_sgl_page_pool.in_use_sgl_list); + LIST_REMOVE(sgl_node, link); sgl_node->sgl_data = sgl; LIST_INSERT_HEAD(&g_hv_sgl_page_pool.free_sgl_list, sgl_node, link); } @@ -1593,12 +1592,12 @@ storvsc_create_bounce_buffer(uint16_t seg_count, int write) struct hv_sgl_node *sgl_node = NULL; /* get struct sglist from free_sgl_list */ - sgl_node = LIST_FIRST(&g_hv_sgl_page_pool.free_sgl_list); - LIST_REMOVE(sgl_node, link); - if (NULL == sgl_node) { + if (LIST_EMPTY(&g_hv_sgl_page_pool.free_sgl_list)) { printf("storvsc error: not enough free sgl\n"); return NULL; } + sgl_node = LIST_FIRST(&g_hv_sgl_page_pool.free_sgl_list); + LIST_REMOVE(sgl_node, link); bounce_sgl = sgl_node->sgl_data; LIST_INSERT_HEAD(&g_hv_sgl_page_pool.in_use_sgl_list, sgl_node, link); |
