diff options
| author | anton <anton@cvs.openbsd.org> | 2020-07-29 05:53:53 +0000 |
|---|---|---|
| committer | anton <anton@cvs.openbsd.org> | 2020-07-29 05:53:53 +0000 |
| commit | 8c7c66e9c0caf18f6b77a3394ff9cd2bd62ddffa (patch) | |
| tree | 032272eb14f1c793fac2a7b536c9ba718c799ec0 /sys/dev | |
| parent | fe787aa63f597e9e33158c6fe29d0d6e095f0a6f (diff) | |
Fix yet another panic in which wsevent_fini() ends up being called with
NULL. This one is a race caused by clearing the me_evp member before
calling routines that could end up sleeping.
While here, make wsmux_mux_close() look more like the other mux close
routines for increased symmetry.
ok mpi@
Reported-by: syzbot+fb9ad34ba42994683850@syzkaller.appspotmail.com
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/wscons/wskbd.c | 6 | ||||
| -rw-r--r-- | sys/dev/wscons/wsmouse.c | 4 | ||||
| -rw-r--r-- | sys/dev/wscons/wsmux.c | 10 |
3 files changed, 11 insertions, 9 deletions
diff --git a/sys/dev/wscons/wskbd.c b/sys/dev/wscons/wskbd.c index 04c2c35f70a..bb49820f7f7 100644 --- a/sys/dev/wscons/wskbd.c +++ b/sys/dev/wscons/wskbd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: wskbd.c,v 1.105 2020/04/26 11:17:56 bru Exp $ */ +/* $OpenBSD: wskbd.c,v 1.106 2020/07/29 05:53:52 anton Exp $ */ /* $NetBSD: wskbd.c,v 1.80 2005/05/04 01:52:16 augustss Exp $ */ /* @@ -889,9 +889,9 @@ wskbd_mux_close(struct wsevsrc *me) { struct wskbd_softc *sc = (struct wskbd_softc *)me; - sc->sc_base.me_evp = NULL; - sc->sc_translating = 1; (void)wskbd_enable(sc, 0); + sc->sc_translating = 1; + sc->sc_base.me_evp = NULL; return (0); } diff --git a/sys/dev/wscons/wsmouse.c b/sys/dev/wscons/wsmouse.c index eba5f5eb00e..6692c724366 100644 --- a/sys/dev/wscons/wsmouse.c +++ b/sys/dev/wscons/wsmouse.c @@ -1,4 +1,4 @@ -/* $OpenBSD: wsmouse.c,v 1.65 2020/05/29 04:42:25 deraadt Exp $ */ +/* $OpenBSD: wsmouse.c,v 1.66 2020/07/29 05:53:52 anton Exp $ */ /* $NetBSD: wsmouse.c,v 1.35 2005/02/27 00:27:52 perry Exp $ */ /* @@ -567,8 +567,8 @@ wsmouse_mux_close(struct wsevsrc *me) { struct wsmouse_softc *sc = (struct wsmouse_softc *)me; - sc->sc_base.me_evp = NULL; (*sc->sc_accessops->disable)(sc->sc_accesscookie); + sc->sc_base.me_evp = NULL; return (0); } diff --git a/sys/dev/wscons/wsmux.c b/sys/dev/wscons/wsmux.c index ce6b237d802..91d3ebdf0a3 100644 --- a/sys/dev/wscons/wsmux.c +++ b/sys/dev/wscons/wsmux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: wsmux.c,v 1.50 2020/03/24 07:53:24 anton Exp $ */ +/* $OpenBSD: wsmux.c,v 1.51 2020/07/29 05:53:52 anton Exp $ */ /* $NetBSD: wsmux.c,v 1.37 2005/04/30 03:47:12 augustss Exp $ */ /* @@ -308,8 +308,11 @@ wsmuxclose(dev_t dev, int flags, int mode, struct proc *p) int wsmux_mux_close(struct wsevsrc *me) { - wsmux_do_close((struct wsmux_softc *)me); - me->me_evp = NULL; + struct wsmux_softc *sc = (struct wsmux_softc *)me; + + wsmux_do_close(sc); + sc->sc_base.me_evp = NULL; + return (0); } @@ -333,7 +336,6 @@ wsmux_do_close(struct wsmux_softc *sc) } #endif (void)wsevsrc_close(me); - me->me_evp = NULL; } rw_exit_read(&sc->sc_lock); } |