[src/trunk]: src/external/cddl/osnet/sys/kern task_executor: prevent use afte...

[hannken <hannken%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/cb0029c22650
branches:  trunk
changeset: 964861:cb0029c22650
user:      hannken <hannken%NetBSD.org@localhost>
date:      Tue Aug 20 08:12:50 2019 +0000

description:
task_executor: prevent use after free, the task function may free
the tasq entry.

diffstat:

 external/cddl/osnet/sys/kern/taskq.c |  6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diffs (33 lines):

diff -r 978b28c5e49c -r cb0029c22650 external/cddl/osnet/sys/kern/taskq.c
--- a/external/cddl/osnet/sys/kern/taskq.c      Tue Aug 20 08:12:14 2019 +0000
+++ b/external/cddl/osnet/sys/kern/taskq.c      Tue Aug 20 08:12:50 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: taskq.c,v 1.10 2019/06/11 09:05:33 hannken Exp $       */
+/*     $NetBSD: taskq.c,v 1.11 2019/08/20 08:12:50 hannken Exp $       */
 
 /*-
  * Copyright (c) 2019 The NetBSD Foundation, Inc.
@@ -75,6 +75,7 @@
        struct taskq_executor *state = (struct taskq_executor *)job;
        taskq_t *tq = state->te_self;
        taskq_ent_t *tqe; 
+       bool is_dynamic;
        int error;
 
        lwp_setspecific(taskq_lwp_key, tq);
@@ -97,13 +98,14 @@
                tqe = SIMPLEQ_FIRST(&tq->tq_list);
                KASSERT(tqe != NULL);
                SIMPLEQ_REMOVE_HEAD(&tq->tq_list, tqent_list);
+               is_dynamic = tqe->tqent_dynamic;
                tqe->tqent_queued = 0;
                mutex_exit(&tq->tq_lock);
 
                (*tqe->tqent_func)(tqe->tqent_arg);
 
                mutex_enter(&tq->tq_lock);
-               if (tqe->tqent_dynamic)
+               if (is_dynamic)
                        kmem_free(tqe, sizeof(*tqe));
                tq->tq_active--;
        }