⬢ DragonFlyBSD Kernel Audit
DF-3787 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/video/bktr/bktr_core.c
+++ b/sys/dev/video/bktr/bktr_core.c
@@ -1016,6 +1016,12 @@
 			 METEOR_CAP_MASK |
 			 METEOR_WANT_MASK);
 
+	/* DF-3787: drop the reference taken by METEORSSIGNAL */
+	if (bktr->proc != NULL) {
+		PRELE(bktr->proc);
+		bktr->proc = NULL;
+	}
+
 	OUTW(bktr, BKTR_GPIO_DMA_CTL, FIFO_RISC_DISABLED);
 	OUTB(bktr, BKTR_CAP_CTL, CAPTURE_OFF);
 
@@ -1492,7 +1498,16 @@
 		if (sig < 0 || sig >= _SIG_MAXSIG)
 			return (EINVAL);
 		bktr->signal = sig;
-		bktr->proc = sig ? td->td_proc : NULL;
+		/* DF-3787: hold a reference; intr ksignal()s it */
+		if (bktr->proc != NULL) {
+			PRELE(bktr->proc);
+			bktr->proc = NULL;
+		}
+		bktr->signal = sig;
+		if (sig) {
+			bktr->proc = td->td_proc;
+			PHOLD(bktr->proc);
+		}
 		break;
 
 	case METEORGSIGNAL: