Date: Sat, 5 Jun 2010 08:58:03 +0000 (UTC) From: Alexander Motin <mav@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r208822 - head/sys/dev/ata Message-ID: <201006050858.o558w3ZE071036@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mav Date: Sat Jun 5 08:58:03 2010 New Revision: 208822 URL: http://svn.freebsd.org/changeset/base/208822 Log: Fix possible use after free. Found with: Coverity Prevent(tm) CID: 4634 Modified: head/sys/dev/ata/atapi-cam.c Modified: head/sys/dev/ata/atapi-cam.c ============================================================================== --- head/sys/dev/ata/atapi-cam.c Sat Jun 5 08:50:39 2010 (r208821) +++ head/sys/dev/ata/atapi-cam.c Sat Jun 5 08:58:03 2010 (r208822) @@ -868,11 +868,11 @@ free_hcb(struct atapi_hcb *hcb) static void free_softc(struct atapi_xpt_softc *scp) { - struct atapi_hcb *hcb; + struct atapi_hcb *hcb, *thcb; if (scp != NULL) { mtx_lock(&scp->state_lock); - TAILQ_FOREACH(hcb, &scp->pending_hcbs, chain) { + TAILQ_FOREACH_SAFE(hcb, &scp->pending_hcbs, chain, thcb) { free_hcb_and_ccb_done(hcb, CAM_UNREC_HBA_ERROR); } if (scp->path != NULL) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201006050858.o558w3ZE071036>