From: Peter Avalos <pavalos@dragonflybsd.org>
Date: Thu, 29 Nov 2007 01:48:15 +0000 (+0000)
Subject: Fix a place where we were referencing a pointer after it had been freed.
X-Git-Tag: v2.0.1~1718
X-Git-Url: https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff_plain/c2183af42368490edd1b1b39f4d4fc37f69596e3

Fix a place where we were referencing a pointer after it had been freed.

Obtained-from: FreeBSD
---

diff --git a/sys/bus/cam/scsi/scsi_ch.c b/sys/bus/cam/scsi/scsi_ch.c
index c3cbdf0d76..77079186f4 100644
--- a/sys/bus/cam/scsi/scsi_ch.c
+++ b/sys/bus/cam/scsi/scsi_ch.c
@@ -25,7 +25,7 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/sys/cam/scsi/scsi_ch.c,v 1.20.2.2 2000/10/31 08:09:49 dwmalone Exp $
- * $DragonFly: src/sys/bus/cam/scsi/scsi_ch.c,v 1.25 2007/11/25 17:59:22 pavalos Exp $
+ * $DragonFly: src/sys/bus/cam/scsi/scsi_ch.c,v 1.26 2007/11/29 01:48:15 pavalos Exp $
  */
 /*
  * Derived from the NetBSD SCSI changer driver.
@@ -1164,6 +1164,8 @@ chgetelemstatus(struct cam_periph *periph,
 	 * Fill in the user status array.
 	 */
 	st_hdr = (struct read_element_status_header *)data;
+	pg_hdr = (struct read_element_status_page_header *)((uintptr_t)st_hdr +
+		  sizeof(struct read_element_status_header));
 	avail = scsi_2btoul(st_hdr->count);
 
 	if (avail != cesr->cesr_element_count) {