[src/jmcneill-audiomp3]: src/sys/dev avoid one use-after-free error. midi_st...

[mrg <mrg%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/9e6ace08557b
branches:  jmcneill-audiomp3
changeset: 771393:9e6ace08557b
user:      mrg <mrg%NetBSD.org@localhost>
date:      Tue Nov 22 06:11:12 2011 +0000

description:
avoid one use-after-free error.  midi_store->lock is unlocked after
we cv_broadcast() to get the midi_store freed.  keep a local copy
of the lock pointer to avoid this.

diffstat:

 sys/dev/midictl.c |  10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diffs (36 lines):

diff -r 1d1d742fcfba -r 9e6ace08557b sys/dev/midictl.c
--- a/sys/dev/midictl.c Tue Nov 22 05:56:43 2011 +0000
+++ b/sys/dev/midictl.c Tue Nov 22 06:11:12 2011 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: midictl.c,v 1.6.32.1 2011/11/19 21:49:35 jmcneill Exp $ */
+/* $NetBSD: midictl.c,v 1.6.32.2 2011/11/22 06:11:12 mrg Exp $ */
 
 /*-
  * Copyright (c) 2006, 2008 The NetBSD Foundation, Inc.
@@ -29,7 +29,7 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: midictl.c,v 1.6.32.1 2011/11/19 21:49:35 jmcneill Exp $");
+__KERNEL_RCSID(0, "$NetBSD: midictl.c,v 1.6.32.2 2011/11/22 06:11:12 mrg Exp $");
 
 /*
  * See midictl.h for an overview of the purpose and use of this module.
@@ -206,13 +206,15 @@
 midictl_close(midictl *mc)
 {
        midictl_store *s;
+       kmutex_t *lock;
 
        s = mc->store;
+       lock = s->lock;
 
-       mutex_enter(s->lock);
+       mutex_enter(lock);
        s->destroy = true;
        cv_broadcast(&s->cv);
-       mutex_exit(s->lock);
+       mutex_exit(lock);
 }
 
 void