⬢ DragonFlyBSD Kernel Audit
DF-5677 / fix.diff
← back to finding ↓ download raw
--- a/sys/libprop/prop_object.c
+++ b/sys/libprop/prop_object.c
@@ -1045,7 +1057,13 @@
 		parent = po;
 		atomic_inc_32(&po->po_refcnt);
 	}
-	_PROP_ASSERT(parent);
+	/*
+	 * If the first iteration broke out (another holder raced a retain,
+	 * or the object freed itself outright), nothing was walked and
+	 * there is no parent to emergency-free.
+	 */
+	if (parent == NULL)
+		return;
 	/* One object was just freed. */
 	po = parent;
 	(*po->po_type->pot_emergency_free)(parent);