diff options
| author | Claudio Jeker <claudio@cvs.openbsd.org> | 2024-04-16 10:06:38 +0000 |
|---|---|---|
| committer | Claudio Jeker <claudio@cvs.openbsd.org> | 2024-04-16 10:06:38 +0000 |
| commit | 9759f8f90188d8f98051de090f1a51ec07747fc6 (patch) | |
| tree | 28ea91cbec31244b047b5bdce47f37ffce333658 | |
| parent | 17e8aa0cc9f2eaf88af188db5fcbed8b37329364 (diff) | |
Call bufq_destroy() in swap_off for the VREG case since swap_on() called
bufq_init(). Similar issue as the use-after-free in mfs.
Missing call noticed by jsg@
OK deraadt@ mpi@
| -rw-r--r-- | sys/uvm/uvm_swap.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/uvm/uvm_swap.c b/sys/uvm/uvm_swap.c index 8c705f2182f..fc0382fd224 100644 --- a/sys/uvm/uvm_swap.c +++ b/sys/uvm/uvm_swap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvm_swap.c,v 1.169 2024/02/03 18:51:59 beck Exp $ */ +/* $OpenBSD: uvm_swap.c,v 1.170 2024/04/16 10:06:37 claudio Exp $ */ /* $NetBSD: uvm_swap.c,v 1.40 2000/11/17 11:39:39 mrg Exp $ */ /* @@ -1088,6 +1088,7 @@ swap_off(struct proc *p, struct swapdev *sdp) */ if (sdp->swd_vp->v_type == VREG) { crfree(sdp->swd_cred); + bufq_destroy(&sdp->swd_bufq); } vrele(sdp->swd_vp); if (sdp->swd_vp != rootvp) { |