From 8f22c0e107257b7c916e7833c3b63856478c8619 Mon Sep 17 00:00:00 2001 From: Marc Balmer Date: Tue, 29 Aug 2006 08:15:11 +0000 Subject: Fix a possible kernel panic in ucom(4) that is caused by ttyclose() using data already freed by ucom_close(). Problem reported and initial patch provided by Marc Winiger ok miod, deraadt --- sys/dev/usb/ucom.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/dev/usb/ucom.c b/sys/dev/usb/ucom.c index 58f4cbccedc..85c5a454856 100644 --- a/sys/dev/usb/ucom.c +++ b/sys/dev/usb/ucom.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ucom.c,v 1.31 2006/08/18 02:54:11 jason Exp $ */ +/* $OpenBSD: ucom.c,v 1.32 2006/08/29 08:15:10 mbalmer Exp $ */ /* $NetBSD: ucom.c,v 1.49 2003/01/01 00:10:25 thorpej Exp $ */ /* @@ -545,11 +545,11 @@ ucomclose(dev_t dev, int flag, int mode, usb_proc_ptr p) (*LINESW(tp, l_close))(tp, flag); s = spltty(); - ucom_cleanup(sc); CLR(tp->t_state, TS_BUSY | TS_FLUSH); sc->sc_cua = 0; - splx(s); ttyclose(tp); + ucom_cleanup(sc); + splx(s); if (sc->sc_methods->ucom_close != NULL) sc->sc_methods->ucom_close(sc->sc_parent, sc->sc_portno); -- cgit v1.2.3