CVS commit: src/sys/dev

["Jaromir Dolecek" <jdolecek%netbsd.org@localhost>]

Module Name:    src
Committed By:   jdolecek
Date:           Mon Apr 13 10:49:35 UTC 2020

Modified Files:
        src/sys/dev/ata: ata.c ata_recovery.c ata_wdc.c atavar.h satapmp_subr.c
            wd.c
        src/sys/dev/ic: ahcisata_core.c mvsata.c siisata.c wdc.c wdcvar.h
        src/sys/dev/scsipi: atapi_wdc.c

Log Message:
fix use-after-free for ata xfer on bio submission found by KASAN

driver ata_bio hooks read parts of the xfer after ata_exec_xfer()
call in order to determine return value, change so that the hook
doesn't return any value - callers do not care already,
as all I/O requests are asynchronous

this problem was uncovered by recent change for wd(4) to not hold
wd mutex during ata_bio call, the interrupt for the xfer might
thus actually fire immediately

adjust also ata_exec_command driver hooks similarily - remove all
completion and waiting logic from drivers, upper layer ata code
using AT_WAIT/AT_POLL changed to call ata_wait_cmd() itself

PR kern/55169 by Nick Hudson


To generate a diff of this commit:
cvs rdiff -u -r1.154 -r1.155 src/sys/dev/ata/ata.c
cvs rdiff -u -r1.3 -r1.4 src/sys/dev/ata/ata_recovery.c
cvs rdiff -u -r1.114 -r1.115 src/sys/dev/ata/ata_wdc.c
cvs rdiff -u -r1.104 -r1.105 src/sys/dev/ata/atavar.h
cvs rdiff -u -r1.15 -r1.16 src/sys/dev/ata/satapmp_subr.c
cvs rdiff -u -r1.461 -r1.462 src/sys/dev/ata/wd.c
cvs rdiff -u -r1.82 -r1.83 src/sys/dev/ic/ahcisata_core.c
cvs rdiff -u -r1.55 -r1.56 src/sys/dev/ic/mvsata.c
cvs rdiff -u -r1.41 -r1.42 src/sys/dev/ic/siisata.c
cvs rdiff -u -r1.298 -r1.299 src/sys/dev/ic/wdc.c
cvs rdiff -u -r1.99 -r1.100 src/sys/dev/ic/wdcvar.h
cvs rdiff -u -r1.137 -r1.138 src/sys/dev/scsipi/atapi_wdc.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.