svn commit: r210163 - stable/8/sys/dev/ata

[Alexander Motin]

Author: mav
Date: Fri Jul 16 09:10:11 2010
New Revision: 210163
URL: http://svn.freebsd.org/changeset/base/210163

Log:
  MFC r208822:
  Fix possible use after free.

Modified:
  stable/8/sys/dev/ata/atapi-cam.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)

Modified: stable/8/sys/dev/ata/atapi-cam.c
==============================================================================
--- stable/8/sys/dev/ata/atapi-cam.c	Fri Jul 16 09:08:16 2010	(r210162)
+++ stable/8/sys/dev/ata/atapi-cam.c	Fri Jul 16 09:10:11 2010	(r210163)
@@ -868,11 +868,11 @@ free_hcb(struct atapi_hcb *hcb)
 static void
 free_softc(struct atapi_xpt_softc *scp)
 {
-    struct atapi_hcb *hcb;
+    struct atapi_hcb *hcb, *thcb;
 
     if (scp != NULL) {
 	mtx_lock(&scp->state_lock);
-	TAILQ_FOREACH(hcb, &scp->pending_hcbs, chain) {
+	TAILQ_FOREACH_SAFE(hcb, &scp->pending_hcbs, chain, thcb) {
 	    free_hcb_and_ccb_done(hcb, CAM_UNREC_HBA_ERROR);
 	}
 	if (scp->path != NULL) {