Close a very narrow race that might cause a trigger allocation to be

leaked if a trigger is delivered as the trigger device is closed.

Obtained from:	TrustedBSD Project

1 files changed, 6 insertions, 7 deletions

diff --git a/sys/security/audit/audit_trigger.c b/sys/security/audit/audit_trigger.c
index c3f47b7..08cacb0 100644
--- a/sys/security/audit/audit_trigger.c
+++ b/sys/security/audit/audit_trigger.c
@@ -132,15 +132,14 @@ send_trigger(unsigned int trigger)
 {
 	struct trigger_info *ti;
 
-	/* If nobody's listening, we ain't talking. */
-	if (!audit_isopen)
-		return (ENODEV);
-
-	/*
-	 * Note: Use a condition variable instead of msleep/wakeup?
-	 */
 	ti = malloc(sizeof *ti, M_AUDITTRIGGER, M_WAITOK);
 	mtx_lock(&audit_trigger_mtx);
+	if (!audit_isopen) {
+		/* If nobody's listening, we ain't talking. */
+		mtx_unlock(&audit_trigger_mtx);
+		free(ti, M_AUDITTRIGGER);
+		return (ENODEV);
+	}
 	ti->trigger = trigger;
 	TAILQ_INSERT_TAIL(&trigger_list, ti, list);
 	wakeup(&trigger_list);