diff options
| author | anton <anton@cvs.openbsd.org> | 2019-02-01 07:02:32 +0000 |
|---|---|---|
| committer | anton <anton@cvs.openbsd.org> | 2019-02-01 07:02:32 +0000 |
| commit | 7325737270ca9aa926f636422c2c9e7f93134ee7 (patch) | |
| tree | d7512767b20e27647059afd9b075aff55f190891 /sys/dev/wscons/wsemul_sun.c | |
| parent | 518dbc9a2a694a3c96dd7ea31385ba69d3c6d61e (diff) | |
In wskbdclose(), use the same logic as in wskbdopen() to determine if
the device was opened in write-only mode. Relying on me_evar being NULL
does not work if the wskbd device was opened first followed by opening a
wsmux device. Closing the wskbd device first at this stage would cause
the wscons_event queue inherited from the wsmux device to be freed. This
in turn could cause a panic if an ioctl(WSMUXIO_INJECTEVENT) command is
issued to the wsmux device.
ok deraadt@ visa@
Reported-by: syzbot+ed88256423ae8d882b8b@syzkaller.appspotmail.com
Diffstat (limited to 'sys/dev/wscons/wsemul_sun.c')
0 files changed, 0 insertions, 0 deletions