Date: Mon, 30 Mar 2009 08:39:43 +0000 (UTC) From: Weongyo Jeong <weongyo@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r190541 - head/sys/dev/malo Message-ID: <200903300839.n2U8dhnW058271@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: weongyo Date: Mon Mar 30 08:39:42 2009 New Revision: 190541 URL: http://svn.freebsd.org/changeset/base/190541 Log: fix a bug of uses after free. Pointed by: dchagin MFC after: 3 days Modified: head/sys/dev/malo/if_malohal.c Modified: head/sys/dev/malo/if_malohal.c ============================================================================== --- head/sys/dev/malo/if_malohal.c Mon Mar 30 05:57:55 2009 (r190540) +++ head/sys/dev/malo/if_malohal.c Mon Mar 30 08:39:42 2009 (r190541) @@ -163,8 +163,6 @@ malo_hal_attach(device_t dev, uint16_t d return (mh); fail: - free(mh, M_DEVBUF); - if (mh->mh_dmamap != NULL) { bus_dmamap_unload(mh->mh_dmat, mh->mh_dmamap); if (mh->mh_cmdbuf != NULL) @@ -174,6 +172,7 @@ fail: } if (mh->mh_dmat) bus_dma_tag_destroy(mh->mh_dmat); + free(mh, M_DEVBUF); return (NULL); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200903300839.n2U8dhnW058271>