From 371d0dd23e3cd7832f78d2158136dc3ae3e15ac8 Mon Sep 17 00:00:00 2001
From: gibbs <gibbs@FreeBSD.org>
Date: Thu, 14 May 1998 19:47:38 +0000
Subject: [PATCH] Fix list corruption and memory leak that could occur when
 releasing EISA irqs.

---
 sys/dev/eisa/eisaconf.c  | 8 ++++++--
 sys/i386/eisa/eisaconf.c | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/sys/dev/eisa/eisaconf.c b/sys/dev/eisa/eisaconf.c
index 02a1691349fd..11418e70bf67 100644
--- a/sys/dev/eisa/eisaconf.c
+++ b/sys/dev/eisa/eisaconf.c
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: eisaconf.c,v 1.33 1997/11/07 08:52:24 phk Exp $
+ *	$Id: eisaconf.c,v 1.34 1998/02/09 06:08:09 eivind Exp $
  */
 
 #include "opt_eisa.h"
@@ -452,10 +452,14 @@ eisa_release_intr(e_dev, irq, func)
 	cur_irq = TAILQ_FIRST(&e_dev->ioconf.irqs);
        	while (cur_irq != NULL) {
 		if (cur_irq->irq_no == irq) {
+			struct	irq_node *next_irq;
+
+			next_irq = TAILQ_NEXT(cur_irq, links);
 			if (cur_irq->idesc != NULL)
 				intr_destroy(cur_irq->idesc);
-			cur_irq = TAILQ_NEXT(cur_irq, links);
 			TAILQ_REMOVE(&e_dev->ioconf.irqs, cur_irq, links);
+			free(cur_irq, M_DEVBUF);
+			cur_irq = next_irq;
 			result = 0;
 		} else {
 			cur_irq = TAILQ_NEXT(cur_irq, links);
diff --git a/sys/i386/eisa/eisaconf.c b/sys/i386/eisa/eisaconf.c
index 02a1691349fd..11418e70bf67 100644
--- a/sys/i386/eisa/eisaconf.c
+++ b/sys/i386/eisa/eisaconf.c
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: eisaconf.c,v 1.33 1997/11/07 08:52:24 phk Exp $
+ *	$Id: eisaconf.c,v 1.34 1998/02/09 06:08:09 eivind Exp $
  */
 
 #include "opt_eisa.h"
@@ -452,10 +452,14 @@ eisa_release_intr(e_dev, irq, func)
 	cur_irq = TAILQ_FIRST(&e_dev->ioconf.irqs);
        	while (cur_irq != NULL) {
 		if (cur_irq->irq_no == irq) {
+			struct	irq_node *next_irq;
+
+			next_irq = TAILQ_NEXT(cur_irq, links);
 			if (cur_irq->idesc != NULL)
 				intr_destroy(cur_irq->idesc);
-			cur_irq = TAILQ_NEXT(cur_irq, links);
 			TAILQ_REMOVE(&e_dev->ioconf.irqs, cur_irq, links);
+			free(cur_irq, M_DEVBUF);
+			cur_irq = next_irq;
 			result = 0;
 		} else {
 			cur_irq = TAILQ_NEXT(cur_irq, links);