Date: Fri, 6 Feb 2015 09:02:11 +0000 (UTC) From: Konstantin Belousov <kib@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r278310 - stable/10/sys/kern Message-ID: <201502060902.t1692BfM090062@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kib Date: Fri Feb 6 09:02:10 2015 New Revision: 278310 URL: https://svnweb.freebsd.org/changeset/base/278310 Log: MFC r278145: Fix use after free in pipe_dtor(). Modified: stable/10/sys/kern/sys_pipe.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/kern/sys_pipe.c ============================================================================== --- stable/10/sys/kern/sys_pipe.c Fri Feb 6 08:58:06 2015 (r278309) +++ stable/10/sys/kern/sys_pipe.c Fri Feb 6 09:02:10 2015 (r278310) @@ -374,15 +374,16 @@ pipe_named_ctor(struct pipe **ppipe, str void pipe_dtor(struct pipe *dpipe) { + struct pipe *peer; ino_t ino; ino = dpipe->pipe_ino; + peer = (dpipe->pipe_state & PIPE_NAMED) != 0 ? dpipe->pipe_peer : NULL; funsetown(&dpipe->pipe_sigio); pipeclose(dpipe); - if (dpipe->pipe_state & PIPE_NAMED) { - dpipe = dpipe->pipe_peer; - funsetown(&dpipe->pipe_sigio); - pipeclose(dpipe); + if (peer != NULL) { + funsetown(&peer->pipe_sigio); + pipeclose(peer); } if (ino != 0 && ino != (ino_t)-1) free_unr(pipeino_unr, ino);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201502060902.t1692BfM090062>