Mateusz Guzik 1f9e8f8ad9 Fix a race between kern_proc_{o,}filedesc_out and fdescfree leading
to use-after-free.

fdescfree proceeds to free file pointers once fd_refcnt reaches 0, but
kern_proc_{o,}filedesc_out only checked for hold count.

MFC after:	3 days
2014-02-21 22:29:09 +00:00
..
2012-08-22 20:01:57 +00:00
2012-03-28 20:58:30 +00:00
2012-11-14 10:33:12 +00:00
2012-06-25 05:41:16 +00:00
2013-11-28 18:56:34 +00:00
2013-09-19 18:56:00 +00:00
2012-10-25 09:05:21 +00:00
2014-01-16 13:42:50 +00:00
2014-01-24 21:05:07 +00:00
2014-01-17 11:09:05 +00:00
2014-01-21 03:24:52 +00:00
2013-06-29 05:05:57 +00:00