[src/netbsd-9]: src/external/cddl/osnet/sys/kern Pull up following revision(s...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8268880cfce8
branches:  netbsd-9
changeset: 843108:8268880cfce8
user:      martin <martin%NetBSD.org@localhost>
date:      Tue Aug 20 11:45:35 2019 +0000

description:
Pull up following revision(s) (requested by hannken in ticket #102):

        external/cddl/osnet/sys/kern/taskq.c: revision 1.11

task_executor: prevent use after free, the task function may free
the tasq entry.

diffstat:

 external/cddl/osnet/sys/kern/taskq.c |  6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diffs (33 lines):

diff -r b09104d26687 -r 8268880cfce8 external/cddl/osnet/sys/kern/taskq.c
--- a/external/cddl/osnet/sys/kern/taskq.c      Tue Aug 20 11:44:14 2019 +0000
+++ b/external/cddl/osnet/sys/kern/taskq.c      Tue Aug 20 11:45:35 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: taskq.c,v 1.10 2019/06/11 09:05:33 hannken Exp $       */
+/*     $NetBSD: taskq.c,v 1.10.2.1 2019/08/20 11:45:35 martin Exp $    */
 
 /*-
  * Copyright (c) 2019 The NetBSD Foundation, Inc.
@@ -75,6 +75,7 @@
        struct taskq_executor *state = (struct taskq_executor *)job;
        taskq_t *tq = state->te_self;
        taskq_ent_t *tqe; 
+       bool is_dynamic;
        int error;
 
        lwp_setspecific(taskq_lwp_key, tq);
@@ -97,13 +98,14 @@
                tqe = SIMPLEQ_FIRST(&tq->tq_list);
                KASSERT(tqe != NULL);
                SIMPLEQ_REMOVE_HEAD(&tq->tq_list, tqent_list);
+               is_dynamic = tqe->tqent_dynamic;
                tqe->tqent_queued = 0;
                mutex_exit(&tq->tq_lock);
 
                (*tqe->tqent_func)(tqe->tqent_arg);
 
                mutex_enter(&tq->tq_lock);
-               if (tqe->tqent_dynamic)
+               if (is_dynamic)
                        kmem_free(tqe, sizeof(*tqe));
                tq->tq_active--;
        }