svn commit: r267075 - stable/8/sys/dev/aac

[John Baldwin]

Author: jhb
Date: Wed Jun  4 18:22:34 2014
New Revision: 267075
URL: http://svnweb.freebsd.org/changeset/base/267075

Log:
  MFC 266281:
  Clear the data buffer length field when freeing a command structure so that
  it doesn't leak through when the command structure is reused for a user
  command without a data buffer.
  
  PR:		189668

Modified:
  stable/8/sys/dev/aac/aac.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/dev/   (props changed)
  stable/8/sys/dev/aac/   (props changed)

Modified: stable/8/sys/dev/aac/aac.c
==============================================================================
--- stable/8/sys/dev/aac/aac.c	Wed Jun  4 18:21:33 2014	(r267074)
+++ stable/8/sys/dev/aac/aac.c	Wed Jun  4 18:22:34 2014	(r267075)
@@ -1398,6 +1398,7 @@ aac_release_command(struct aac_command *
 	fwprintf(sc, HBA_FLAGS_DBG_FUNCTION_ENTRY_B, "");
 
 	/* (re)initialize the command/FIB */
+	cm->cm_datalen = 0;
 	cm->cm_sgtable = NULL;
 	cm->cm_flags = 0;
 	cm->cm_complete = NULL;