diff options
| author | Alexandre Ratchov <ratchov@cvs.openbsd.org> | 2010-06-25 07:32:06 +0000 |
|---|---|---|
| committer | Alexandre Ratchov <ratchov@cvs.openbsd.org> | 2010-06-25 07:32:06 +0000 |
| commit | 5391d7a0f83d8a9499059a78ad8939ed9e58757f (patch) | |
| tree | 057ae2e61c99c87fb18ee140738fddb1ac23d4d3 /usr.bin/aucat/dev.c | |
| parent | 3bc361ce722cd2e583d357787c855db75cb54b18 (diff) | |
don't attempt to drain devices after they are destroyed, which
results in a use after free(). Catched by jakemsr@ with MALLOC_OPTIONS=J
Diffstat (limited to 'usr.bin/aucat/dev.c')
| -rw-r--r-- | usr.bin/aucat/dev.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/usr.bin/aucat/dev.c b/usr.bin/aucat/dev.c index 5815d84b733..0b5005c4356 100644 --- a/usr.bin/aucat/dev.c +++ b/usr.bin/aucat/dev.c @@ -1,4 +1,4 @@ -/* $OpenBSD: dev.c,v 1.59 2010/06/05 16:14:44 ratchov Exp $ */ +/* $OpenBSD: dev.c,v 1.60 2010/06/25 07:32:05 ratchov Exp $ */ /* * Copyright (c) 2008 Alexandre Ratchov <alex@caoua.org> * @@ -533,6 +533,16 @@ dev_close(struct dev *d) } /* + * Unless the device is already in process of closing, request it to close + */ +void +dev_drain(struct dev *d) +{ + if (d->pstate != DEV_CLOSED) + dev_close(d); +} + +/* * Free the device */ void @@ -540,8 +550,7 @@ dev_del(struct dev *d) { struct dev **p; - if (d->pstate != DEV_CLOSED) - dev_close(d); + dev_drain(d); for (p = &dev_list; *p != d; p = &(*p)->next) { #ifdef DEBUG if (*p == NULL) { |