DragonFlyBSD Kernel Audit
DF-2680 / fix.diff
← back to finding ↓ download raw
--- a/sys/kern/subr_bus.c
+++ b/sys/kern/subr_bus.c
@@ -352,10 +352,14 @@ devopen(struct dev_close_args *ap)
 static int
 devclose(struct dev_close_args *ap)
 {
 	lockmgr(&devsoftc.lock, LK_EXCLUSIVE);
 	devsoftc.inuse = 0;
+	/*
+	 * DF-2680: async_proc is a raw curproc pointer captured by
+	 * FIOASYNC with no reference; it must not outlive the owner.
+	 */
+	devsoftc.async_proc = NULL;
 	wakeup(&devsoftc);
 	lockmgr(&devsoftc.lock, LK_RELEASE);
 
 	return (0);
 }