Date: Fri, 29 Mar 2024 15:32:57 GMT From: Christos Margiolis <christos@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: fba54d0179aa - main - sound: Drain buffer selinfo in sndbuf_free() Message-ID: <202403291532.42TFWvOs011307@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=fba54d0179aabb3d94211ca80f94fe5b98ac6d3b commit fba54d0179aabb3d94211ca80f94fe5b98ac6d3b Author: Christos Margiolis <christos@FreeBSD.org> AuthorDate: 2024-03-29 15:29:23 +0000 Commit: Christos Margiolis <christos@FreeBSD.org> CommitDate: 2024-03-29 15:29:23 +0000 sound: Drain buffer selinfo in sndbuf_free() Prevent a use-after-free in kern_poll() by making sure the buffer's selinfo is drained. This is required for a subsequent patch that implements asynchronous audio device detach. Reported by: KASAN Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D44544 --- sys/dev/sound/pcm/buffer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/dev/sound/pcm/buffer.c b/sys/dev/sound/pcm/buffer.c index 915c9110f107..afb4b95e357a 100644 --- a/sys/dev/sound/pcm/buffer.c +++ b/sys/dev/sound/pcm/buffer.c @@ -147,6 +147,7 @@ sndbuf_free(struct snd_dbuf *b) } else free(b->buf, M_DEVBUF); } + seldrain(sndbuf_getsel(b)); b->tmpbuf = NULL; b->shadbuf = NULL;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202403291532.42TFWvOs011307>