Date: Fri, 16 Jul 2010 09:10:11 +0000 (UTC) From: Alexander Motin <mav@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org Subject: svn commit: r210163 - stable/8/sys/dev/ata Message-ID: <201007160910.o6G9ABuB062234@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mav Date: Fri Jul 16 09:10:11 2010 New Revision: 210163 URL: http://svn.freebsd.org/changeset/base/210163 Log: MFC r208822: Fix possible use after free. Modified: stable/8/sys/dev/ata/atapi-cam.c Directory Properties: stable/8/sys/ (props changed) stable/8/sys/amd64/include/xen/ (props changed) stable/8/sys/cddl/contrib/opensolaris/ (props changed) stable/8/sys/contrib/dev/acpica/ (props changed) stable/8/sys/contrib/pf/ (props changed) stable/8/sys/dev/xen/xenpci/ (props changed) Modified: stable/8/sys/dev/ata/atapi-cam.c ============================================================================== --- stable/8/sys/dev/ata/atapi-cam.c Fri Jul 16 09:08:16 2010 (r210162) +++ stable/8/sys/dev/ata/atapi-cam.c Fri Jul 16 09:10:11 2010 (r210163) @@ -868,11 +868,11 @@ free_hcb(struct atapi_hcb *hcb) static void free_softc(struct atapi_xpt_softc *scp) { - struct atapi_hcb *hcb; + struct atapi_hcb *hcb, *thcb; if (scp != NULL) { mtx_lock(&scp->state_lock); - TAILQ_FOREACH(hcb, &scp->pending_hcbs, chain) { + TAILQ_FOREACH_SAFE(hcb, &scp->pending_hcbs, chain, thcb) { free_hcb_and_ccb_done(hcb, CAM_UNREC_HBA_ERROR); } if (scp->path != NULL) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201007160910.o6G9ABuB062234>