From 53bc1d83c05ca86cbceedc55e49cd1c8f6fa530e Mon Sep 17 00:00:00 2001 From: Ariff Abdullah Date: Fri, 4 May 2007 12:38:46 +0000 Subject: [PATCH] Fix use-after-free for DMA tag. Destroy DMA tag later. Submitted by: Yuriy Tsibizov --- sys/dev/sound/pci/emu10kx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sys/dev/sound/pci/emu10kx.c b/sys/dev/sound/pci/emu10kx.c index 6f46c8d9042..f45512041c9 100644 --- a/sys/dev/sound/pci/emu10kx.c +++ b/sys/dev/sound/pci/emu10kx.c @@ -2614,9 +2614,6 @@ emu_uninit(struct emu_sc_info *sc) emu_wrptr(sc, 0, SOLEL, 0); emu_wrptr(sc, 0, SOLEH, 0); - if (sc->mem.dmat) - bus_dma_tag_destroy(sc->mem.dmat); - if (!SLIST_EMPTY(&sc->mem.blocks)) device_printf(sc->dev, "warning: memblock list not empty\n"); @@ -3103,6 +3100,10 @@ emu_pci_detach(device_t dev) if (r) return (r); emu_rm_uninit(sc); + + if (sc->mem.dmat) + bus_dma_tag_destroy(sc->mem.dmat); + if (sc->reg) bus_release_resource(dev, SYS_RES_IOPORT, PCIR_BAR(0), sc->reg); bus_teardown_intr(dev, sc->irq, sc->ih);