[src/trunk]: src/sys/arch/pmax/tc Use-after-free.

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/91f2ad9b07a6
branches:  trunk
changeset: 339128:91f2ad9b07a6
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sun Jun 28 09:15:45 2015 +0000

description:
Use-after-free.

ok christos@

Found by The Brainy Code Scanner.

diffstat:

 sys/arch/pmax/tc/dt.c |  5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diffs (26 lines):

diff -r 748014ea8453 -r 91f2ad9b07a6 sys/arch/pmax/tc/dt.c
--- a/sys/arch/pmax/tc/dt.c     Sat Jun 27 21:44:06 2015 +0000
+++ b/sys/arch/pmax/tc/dt.c     Sun Jun 28 09:15:45 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: dt.c,v 1.11 2011/06/04 01:37:36 tsutsui Exp $  */
+/*     $NetBSD: dt.c,v 1.12 2015/06/28 09:15:45 maxv Exp $     */
 
 /*-
  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
@@ -133,7 +133,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: dt.c,v 1.11 2011/06/04 01:37:36 tsutsui Exp $");
+__KERNEL_RCSID(0, "$NetBSD: dt.c,v 1.12 2015/06/28 09:15:45 maxv Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -225,6 +225,7 @@
        if (sc->sc_sih == NULL) {
                printf("%s: memory exhausted\n", device_xname(self));
                free(msg, M_DEVBUF);
+               return;
        }
 
        SIMPLEQ_INIT(&sc->sc_queue);