diff options
| author | anton <anton@cvs.openbsd.org> | 2019-05-21 20:57:11 +0000 |
|---|---|---|
| committer | anton <anton@cvs.openbsd.org> | 2019-05-21 20:57:11 +0000 |
| commit | 2bdaaa2dc8fdb050bb8f43706af7e4335e5c4800 (patch) | |
| tree | 69ea9ec27b013d24d788d64fed1f7fe3f2a0b7a7 /sys/dev/acpi/acpipwrres.c | |
| parent | 7dac9df47f7f2951a2dcd471bc8643663e09a140 (diff) | |
A problem fixed in wskbd is also present in wsmux. Repeating the
previous commit message:
In wsmuxclose(), use the same logic as in wsmuxopen() to determine if
the device was opened in write-only mode. Relying on me_evar being NULL
does not work if the wsmux device was opened first followed attaching it
to another wsmux. Closing the wsmux device first at this stage would
cause the wscons_event queue inherited from the parent wsmux to be
freed. This in turn could cause a panic if an ioctl(WSMUXIO_INJECTEVENT)
command is issued on parent wsmux device.
ok mpi@ visa@
Reported-by: syzbot+f6c2ed7901eb4b970720@syzkaller.appspotmail.com
Diffstat (limited to 'sys/dev/acpi/acpipwrres.c')
0 files changed, 0 insertions, 0 deletions