d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

In aio_waitcomplete() correct two cases of using an aiocb after freeing it.

Browse Source
This commit is contained in:
Alan Cox 2005-06-02 23:14:38 +00:00
parent d97f4741a4
commit e293dc860c
1 changed files with 4 additions and 2 deletions

6
sys/kern/vfs_aio.c

@ -2246,17 +2246,19 @@ aio_waitcomplete(struct thread *td, struct aio_waitcomplete_args *uap)
p->p_stats->p_ru.ru_inblock += cb->inputcharge;
cb->inputcharge = 0;
}
error = cb->uaiocb._aiocb_private.error;
aio_free_entry(cb);
return (cb->uaiocb._aiocb_private.error);
return (error);
}
s = splbio();
if ((cb = TAILQ_FIRST(&ki->kaio_bufdone)) != 0 ) {
splx(s);
suword(uap->aiocbp, (uintptr_t)cb->uuaiocb);
error = cb->uaiocb._aiocb_private.error;
td->td_retval[0] = cb->uaiocb._aiocb_private.status;
aio_free_entry(cb);
return (cb->uaiocb._aiocb_private.error);
return (error);
}
ki->kaio_flags |= KAIO_WAKEUP;