diff options
| author | Jonathan Gray <jsg@cvs.openbsd.org> | 2023-05-03 15:25:26 +0000 |
|---|---|---|
| committer | Jonathan Gray <jsg@cvs.openbsd.org> | 2023-05-03 15:25:26 +0000 |
| commit | 92966cceb69bd29831663e21ffb86b730dcad2f6 (patch) | |
| tree | cd80aeda9e441dc7d549050c2237205687405c40 /sys/dev | |
| parent | f4a7ce92a351bc75eb98914814acb25097a61e86 (diff) | |
avoid use after free
ok miod@ millert@
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/fdt/dwpcie.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/dev/fdt/dwpcie.c b/sys/dev/fdt/dwpcie.c index d1fb8e57856..bfcd83f763f 100644 --- a/sys/dev/fdt/dwpcie.c +++ b/sys/dev/fdt/dwpcie.c @@ -1,4 +1,4 @@ -/* $OpenBSD: dwpcie.c,v 1.48 2023/04/27 09:03:06 kettenis Exp $ */ +/* $OpenBSD: dwpcie.c,v 1.49 2023/05/03 15:25:25 jsg Exp $ */ /* * Copyright (c) 2018 Mark Kettenis <kettenis@openbsd.org> * @@ -1480,13 +1480,14 @@ dwpcie_rk3568_intr_disestablish(void *cookie) evcount_detach(&di->di_count); TAILQ_REMOVE(&sc->sc_intx[di->di_pin], di, di_next); - free(di, M_DEVBUF, sizeof(*di)); if (!TAILQ_EMPTY(&sc->sc_intx[di->di_pin])) { /* Unmask the interrupt. */ bus_space_write_4(sc->sc_iot, sc->sc_glue_ioh, PCIE_CLIENT_INTR_MASK_LEGACY, mask << 16); } + + free(di, M_DEVBUF, sizeof(*di)); } void |