Module Name: src
Committed By: joerg
Date: Sun Apr 6 00:56:39 UTC 2014
Modified Files:
src/sys/dev: ccd.c
Log Message:
Don't destroy locked mutex. Don't access freed memory.
To generate a diff of this commit:
cvs rdiff -u -r1.147 -r1.148 src/sys/dev/ccd.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/ccd.c
diff -u src/sys/dev/ccd.c:1.147 src/sys/dev/ccd.c:1.148
--- src/sys/dev/ccd.c:1.147 Tue Feb 25 18:30:09 2014
+++ src/sys/dev/ccd.c Sun Apr 6 00:56:39 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: ccd.c,v 1.147 2014/02/25 18:30:09 pooka Exp $ */
+/* $NetBSD: ccd.c,v 1.148 2014/04/06 00:56:39 joerg Exp $ */
/*-
* Copyright (c) 1996, 1997, 1998, 1999, 2007, 2009 The NetBSD Foundation, Inc.
@@ -88,7 +88,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ccd.c,v 1.147 2014/02/25 18:30:09 pooka Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ccd.c,v 1.148 2014/04/06 00:56:39 joerg Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -231,6 +231,7 @@ ccdcreate(int unit) {
static void
ccddestroy(struct ccd_softc *sc) {
mutex_obj_free(sc->sc_iolock);
+ mutex_exit(&sc->sc_dvlock);
mutex_destroy(&sc->sc_dvlock);
cv_destroy(&sc->sc_stop);
cv_destroy(&sc->sc_push);
@@ -1271,7 +1272,8 @@ ccdioctl(dev_t dev, u_long cmd, void *da
disk_detach(&cs->sc_dkdev);
bufq_free(cs->sc_bufq);
ccdput(cs);
- break;
+ /* Don't break, otherwise cs is read again. */
+ return 0;
case DIOCGDINFO:
*(struct disklabel *)data = *(cs->sc_dkdev.dk_label);
