DragonFlyBSD Kernel Audit
DF-1097 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/bus/firewire/fwohci_pci.c b/sys/bus/firewire/fwohci_pci.c
--- a/sys/bus/firewire/fwohci_pci.c
+++ b/sys/bus/firewire/fwohci_pci.c
@@ -443,6 +443,15 @@
 	if (err) {
 		device_printf(parent, "probe_and_attach failed with err=%d\n",
 		    err);
+		/*
+		 * Clear fc.bdev so fwohci_pci_detach() does not call
+		 * device_delete_child(self, sc->fc.bdev) on the child we
+		 * are about to delete ourselves.  Otherwise the detach
+		 * frees the child (kobj_delete in subr_bus.c:1306) and the
+		 * explicit device_delete_child below dereferences freed
+		 * memory and double-frees it.
+		 */
+		sc->fc.bdev = NULL;
 		fwohci_pci_detach(parent);
 		device_delete_child(parent, child);
 		return NULL;