svn commit: r278310 - stable/10/sys/kern

[Konstantin Belousov]

Author: kib
Date: Fri Feb  6 09:02:10 2015
New Revision: 278310
URL: https://svnweb.freebsd.org/changeset/base/278310

Log:
  MFC r278145:
  Fix use after free in pipe_dtor().

Modified:
  stable/10/sys/kern/sys_pipe.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/kern/sys_pipe.c
==============================================================================
--- stable/10/sys/kern/sys_pipe.c	Fri Feb  6 08:58:06 2015	(r278309)
+++ stable/10/sys/kern/sys_pipe.c	Fri Feb  6 09:02:10 2015	(r278310)
@@ -374,15 +374,16 @@ pipe_named_ctor(struct pipe **ppipe, str
 void
 pipe_dtor(struct pipe *dpipe)
 {
+	struct pipe *peer;
 	ino_t ino;
 
 	ino = dpipe->pipe_ino;
+	peer = (dpipe->pipe_state & PIPE_NAMED) != 0 ? dpipe->pipe_peer : NULL;
 	funsetown(&dpipe->pipe_sigio);
 	pipeclose(dpipe);
-	if (dpipe->pipe_state & PIPE_NAMED) {
-		dpipe = dpipe->pipe_peer;
-		funsetown(&dpipe->pipe_sigio);
-		pipeclose(dpipe);
+	if (peer != NULL) {
+		funsetown(&peer->pipe_sigio);
+		pipeclose(peer);
 	}
 	if (ino != 0 && ino != (ino_t)-1)
 		free_unr(pipeino_unr, ino);