PR/54008 CVS commit: src/sys/dev/pci

["Maxime Villard" <maxv%netbsd.org@localhost>]

The following reply was made to PR kern/54008; it has been noted by GNATS.

From: "Maxime Villard" <maxv%netbsd.org@localhost>
To: gnats-bugs%gnats.NetBSD.org@localhost
Cc: 
Subject: PR/54008 CVS commit: src/sys/dev/pci
Date: Sat, 13 Apr 2019 06:17:33 +0000

 Module Name:	src
 Committed By:	maxv
 Date:		Sat Apr 13 06:17:33 UTC 2019
 
 Modified Files:
 	src/sys/dev/pci: vioscsi.c
 
 Log Message:
 Fix use-after-free. If we're not polling, virtio_enqueue_commit() will send
 the transaction, and it means 'xs' can be immediately freed. So, save the
 value of xs_control beforehand.
 
 Detected by KASAN, ok jdolecek@.
 
 Fixes PR/54008
 Reported-by: syzbot+6513c4afe66237d7207f%syzkaller.appspotmail.com@localhost
 
 
 To generate a diff of this commit:
 cvs rdiff -u -r1.20 -r1.21 src/sys/dev/pci/vioscsi.c
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.