Author: kib
Date: Fri Feb 6 09:02:10 2015
New Revision: 278310
URL: https://svnweb.freebsd.org/changeset/base/278310
Log:
MFC r278145:
Fix use after free in pipe_dtor().
Modified:
stable/10/sys/kern/sys_pipe.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/kern/sys_pipe.c
==============================================================================
--- stable/10/sys/kern/sys_pipe.c Fri Feb 6 08:58:06 2015
(r278309)
+++ stable/10/sys/kern/sys_pipe.c Fri Feb 6 09:02:10 2015
(r278310)
@@ -374,15 +374,16 @@ pipe_named_ctor(struct pipe **ppipe, str
void
pipe_dtor(struct pipe *dpipe)
{
+ struct pipe *peer;
ino_t ino;
ino = dpipe->pipe_ino;
+ peer = (dpipe->pipe_state & PIPE_NAMED) != 0 ? dpipe->pipe_peer : NULL;
funsetown(&dpipe->pipe_sigio);
pipeclose(dpipe);
- if (dpipe->pipe_state & PIPE_NAMED) {
- dpipe = dpipe->pipe_peer;
- funsetown(&dpipe->pipe_sigio);
- pipeclose(dpipe);
+ if (peer != NULL) {
+ funsetown(&peer->pipe_sigio);
+ pipeclose(peer);
}
if (ino != 0 && ino != (ino_t)-1)
free_unr(pipeino_unr, ino);
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
