d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFC r278145:

Browse Source 
Fix use after free in pipe_dtor().
This commit is contained in:
kib 2015-02-06 09:02:10 +00:00
parent e0c8cbf143
commit d00b9ac996
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/kern/sys_pipe.c
View File

@ -374,15 +374,16 @@ pipe_named_ctor(struct pipe **ppipe, struct thread *td)
void
pipe_dtor(struct pipe *dpipe)
{
struct pipe *peer;
ino_t ino;
ino = dpipe->pipe_ino;
peer = (dpipe->pipe_state & PIPE_NAMED) != 0 ? dpipe->pipe_peer : NULL;
funsetown(&dpipe->pipe_sigio);
pipeclose(dpipe);
if (dpipe->pipe_state & PIPE_NAMED) {
dpipe = dpipe->pipe_peer;
funsetown(&dpipe->pipe_sigio);
pipeclose(dpipe);
if (peer != NULL) {
funsetown(&peer->pipe_sigio);
pipeclose(peer);
}
if (ino != 0 && ino != (ino_t)-1)
free_unr(pipeino_unr, ino);