PR/55169 CVS commit: src/sys/dev

["Jaromir Dolecek" <jdolecek%netbsd.org@localhost>]

The following reply was made to PR kern/55169; it has been noted by GNATS.

From: "Jaromir Dolecek" <jdolecek%netbsd.org@localhost>
To: gnats-bugs%gnats.NetBSD.org@localhost
Cc: 
Subject: PR/55169 CVS commit: src/sys/dev
Date: Mon, 13 Apr 2020 10:49:35 +0000

 Module Name:	src
 Committed By:	jdolecek
 Date:		Mon Apr 13 10:49:35 UTC 2020
 
 Modified Files:
 	src/sys/dev/ata: ata.c ata_recovery.c ata_wdc.c atavar.h satapmp_subr.c
 	    wd.c
 	src/sys/dev/ic: ahcisata_core.c mvsata.c siisata.c wdc.c wdcvar.h
 	src/sys/dev/scsipi: atapi_wdc.c
 
 Log Message:
 fix use-after-free for ata xfer on bio submission found by KASAN
 
 driver ata_bio hooks read parts of the xfer after ata_exec_xfer()
 call in order to determine return value, change so that the hook
 doesn't return any value - callers do not care already,
 as all I/O requests are asynchronous
 
 this problem was uncovered by recent change for wd(4) to not hold
 wd mutex during ata_bio call, the interrupt for the xfer might
 thus actually fire immediately
 
 adjust also ata_exec_command driver hooks similarily - remove all
 completion and waiting logic from drivers, upper layer ata code
 using AT_WAIT/AT_POLL changed to call ata_wait_cmd() itself
 
 PR kern/55169 by Nick Hudson
 
 
 To generate a diff of this commit:
 cvs rdiff -u -r1.154 -r1.155 src/sys/dev/ata/ata.c
 cvs rdiff -u -r1.3 -r1.4 src/sys/dev/ata/ata_recovery.c
 cvs rdiff -u -r1.114 -r1.115 src/sys/dev/ata/ata_wdc.c
 cvs rdiff -u -r1.104 -r1.105 src/sys/dev/ata/atavar.h
 cvs rdiff -u -r1.15 -r1.16 src/sys/dev/ata/satapmp_subr.c
 cvs rdiff -u -r1.461 -r1.462 src/sys/dev/ata/wd.c
 cvs rdiff -u -r1.82 -r1.83 src/sys/dev/ic/ahcisata_core.c
 cvs rdiff -u -r1.55 -r1.56 src/sys/dev/ic/mvsata.c
 cvs rdiff -u -r1.41 -r1.42 src/sys/dev/ic/siisata.c
 cvs rdiff -u -r1.298 -r1.299 src/sys/dev/ic/wdc.c
 cvs rdiff -u -r1.99 -r1.100 src/sys/dev/ic/wdcvar.h
 cvs rdiff -u -r1.137 -r1.138 src/sys/dev/scsipi/atapi_wdc.c
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.