svn commit: r208822 - head/sys/dev/ata

Alexander Motin mav at FreeBSD.org
Sat Jun 5 08:58:04 UTC 2010


Author: mav
Date: Sat Jun  5 08:58:03 2010
New Revision: 208822
URL: http://svn.freebsd.org/changeset/base/208822

Log:
  Fix possible use after free.
  
  Found with:   Coverity Prevent(tm)
  CID:          4634

Modified:
  head/sys/dev/ata/atapi-cam.c

Modified: head/sys/dev/ata/atapi-cam.c
==============================================================================
--- head/sys/dev/ata/atapi-cam.c	Sat Jun  5 08:50:39 2010	(r208821)
+++ head/sys/dev/ata/atapi-cam.c	Sat Jun  5 08:58:03 2010	(r208822)
@@ -868,11 +868,11 @@ free_hcb(struct atapi_hcb *hcb)
 static void
 free_softc(struct atapi_xpt_softc *scp)
 {
-    struct atapi_hcb *hcb;
+    struct atapi_hcb *hcb, *thcb;
 
     if (scp != NULL) {
 	mtx_lock(&scp->state_lock);
-	TAILQ_FOREACH(hcb, &scp->pending_hcbs, chain) {
+	TAILQ_FOREACH_SAFE(hcb, &scp->pending_hcbs, chain, thcb) {
 	    free_hcb_and_ccb_done(hcb, CAM_UNREC_HBA_ERROR);
 	}
 	if (scp->path != NULL) {


More information about the svn-src-head mailing list