diff options
| author | gibbs <gibbs@FreeBSD.org> | 1998-05-14 19:47:38 +0000 |
|---|---|---|
| committer | gibbs <gibbs@FreeBSD.org> | 1998-05-14 19:47:38 +0000 |
| commit | 7c2692687f121dfa47c898873a2f1f63caf5cb4f (patch) | |
| tree | 2ff947a70f86d6320116a32ed95a07386e968484 | |
| parent | 2c45b9f71cb6c84dd050dafc7488cad715de0c22 (diff) | |
| download | FreeBSD-src-7c2692687f121dfa47c898873a2f1f63caf5cb4f.zip FreeBSD-src-7c2692687f121dfa47c898873a2f1f63caf5cb4f.tar.gz | |
Fix list corruption and memory leak that could occur when
releasing EISA irqs.
| -rw-r--r-- | sys/dev/eisa/eisaconf.c | 8 | ||||
| -rw-r--r-- | sys/i386/eisa/eisaconf.c | 8 |
2 files changed, 12 insertions, 4 deletions
diff --git a/sys/dev/eisa/eisaconf.c b/sys/dev/eisa/eisaconf.c index 02a1691..11418e7 100644 --- a/sys/dev/eisa/eisaconf.c +++ b/sys/dev/eisa/eisaconf.c @@ -28,7 +28,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $Id: eisaconf.c,v 1.33 1997/11/07 08:52:24 phk Exp $ + * $Id: eisaconf.c,v 1.34 1998/02/09 06:08:09 eivind Exp $ */ #include "opt_eisa.h" @@ -452,10 +452,14 @@ eisa_release_intr(e_dev, irq, func) cur_irq = TAILQ_FIRST(&e_dev->ioconf.irqs); while (cur_irq != NULL) { if (cur_irq->irq_no == irq) { + struct irq_node *next_irq; + + next_irq = TAILQ_NEXT(cur_irq, links); if (cur_irq->idesc != NULL) intr_destroy(cur_irq->idesc); - cur_irq = TAILQ_NEXT(cur_irq, links); TAILQ_REMOVE(&e_dev->ioconf.irqs, cur_irq, links); + free(cur_irq, M_DEVBUF); + cur_irq = next_irq; result = 0; } else { cur_irq = TAILQ_NEXT(cur_irq, links); diff --git a/sys/i386/eisa/eisaconf.c b/sys/i386/eisa/eisaconf.c index 02a1691..11418e7 100644 --- a/sys/i386/eisa/eisaconf.c +++ b/sys/i386/eisa/eisaconf.c @@ -28,7 +28,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $Id: eisaconf.c,v 1.33 1997/11/07 08:52:24 phk Exp $ + * $Id: eisaconf.c,v 1.34 1998/02/09 06:08:09 eivind Exp $ */ #include "opt_eisa.h" @@ -452,10 +452,14 @@ eisa_release_intr(e_dev, irq, func) cur_irq = TAILQ_FIRST(&e_dev->ioconf.irqs); while (cur_irq != NULL) { if (cur_irq->irq_no == irq) { + struct irq_node *next_irq; + + next_irq = TAILQ_NEXT(cur_irq, links); if (cur_irq->idesc != NULL) intr_destroy(cur_irq->idesc); - cur_irq = TAILQ_NEXT(cur_irq, links); TAILQ_REMOVE(&e_dev->ioconf.irqs, cur_irq, links); + free(cur_irq, M_DEVBUF); + cur_irq = next_irq; result = 0; } else { cur_irq = TAILQ_NEXT(cur_irq, links); |
