diff options
| author | hselasky <hselasky@FreeBSD.org> | 2014-07-03 06:44:55 +0000 |
|---|---|---|
| committer | hselasky <hselasky@FreeBSD.org> | 2014-07-03 06:44:55 +0000 |
| commit | 0553ac94fa339d7dd6192dd23056b8fd3c5daffa (patch) | |
| tree | ae93dc40f8f19cb05fcfaa60fca946ba17bf2543 | |
| parent | 780c455ef488570c16e2b029e6c20d597c612e43 (diff) | |
| download | FreeBSD-src-0553ac94fa339d7dd6192dd23056b8fd3c5daffa.zip FreeBSD-src-0553ac94fa339d7dd6192dd23056b8fd3c5daffa.tar.gz | |
MFC r268078 and r268080:
Fix for memory use after free() and mtx_destroy().
| -rw-r--r-- | sys/dev/usb/net/uhso.c | 7 | ||||
| -rw-r--r-- | sys/dev/usb/serial/usb_serial.c | 2 | ||||
| -rw-r--r-- | sys/dev/usb/serial/usb_serial.h | 2 |
3 files changed, 4 insertions, 7 deletions
diff --git a/sys/dev/usb/net/uhso.c b/sys/dev/usb/net/uhso.c index 1fc28a8..1795993 100644 --- a/sys/dev/usb/net/uhso.c +++ b/sys/dev/usb/net/uhso.c @@ -558,8 +558,6 @@ uhso_attach(device_t self) mtx_init(&sc->sc_mtx, "uhso", NULL, MTX_DEF); ucom_ref(&sc->sc_super_ucom); - sc->sc_ucom = NULL; - sc->sc_ttys = 0; sc->sc_radio = 1; id = usbd_get_interface_descriptor(uaa->iface); @@ -679,9 +677,6 @@ uhso_detach(device_t self) UHSO_CTRL_MAX); } } - - free(sc->sc_tty, M_USBDEV); - free(sc->sc_ucom, M_USBDEV); } if (sc->sc_ifp != NULL) { @@ -709,6 +704,8 @@ static void uhso_free_softc(struct uhso_softc *sc) { if (ucom_unref(&sc->sc_super_ucom)) { + free(sc->sc_tty, M_USBDEV); + free(sc->sc_ucom, M_USBDEV); mtx_destroy(&sc->sc_mtx); device_free_softc(sc); } diff --git a/sys/dev/usb/serial/usb_serial.c b/sys/dev/usb/serial/usb_serial.c index 2945415..a34f684 100644 --- a/sys/dev/usb/serial/usb_serial.c +++ b/sys/dev/usb/serial/usb_serial.c @@ -203,7 +203,7 @@ ucom_uninit(void *arg) mtx_destroy(&ucom_mtx); } -SYSUNINIT(ucom_uninit, SI_SUB_KLD - 2, SI_ORDER_ANY, ucom_uninit, NULL); +SYSUNINIT(ucom_uninit, SI_SUB_KLD - 3, SI_ORDER_ANY, ucom_uninit, NULL); /* * Mark a unit number (the X in cuaUX) as in use. diff --git a/sys/dev/usb/serial/usb_serial.h b/sys/dev/usb/serial/usb_serial.h index 5c6e71c..8fdf988 100644 --- a/sys/dev/usb/serial/usb_serial.h +++ b/sys/dev/usb/serial/usb_serial.h @@ -195,7 +195,7 @@ struct ucom_softc { #define UCOM_MTX_LOCK(sc) mtx_lock((sc)->sc_mtx) #define UCOM_MTX_UNLOCK(sc) mtx_unlock((sc)->sc_mtx) #define UCOM_UNLOAD_DRAIN(x) \ -SYSUNINIT(var, SI_SUB_KLD - 3, SI_ORDER_ANY, ucom_drain_all, 0) +SYSUNINIT(var, SI_SUB_KLD - 2, SI_ORDER_ANY, ucom_drain_all, 0) #define ucom_cfg_do_request(udev,com,req,ptr,flags,timo) \ usbd_do_request_proc(udev,&(com)->sc_super->sc_tq,req,ptr,flags,NULL,timo) |
