avoid use after free

ok miod@ kettenis@

diff --git a/sys/arch/arm64/dev/aplpinctrl.c b/sys/arch/arm64/dev/aplpinctrl.c
index e2145b0..e6c680c 100644 (file)
--- a/sys/arch/arm64/dev/aplpinctrl.c
+++ b/sys/arch/arm64/dev/aplpinctrl.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: aplpinctrl.c,v 1.6 2023/03/05 14:45:07 patrick Exp $  */
+/*     $OpenBSD: aplpinctrl.c,v 1.7 2023/03/23 11:40:42 jsg Exp $      */
 /*
  * Copyright (c) 2021 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -388,7 +388,6 @@ aplpinctrl_intr_disestablish(void *cookie)
        TAILQ_REMOVE(&sc->sc_handler[ih->ih_irq], ih, ih_list);
        if (ih->ih_name)
                evcount_detach(&ih->ih_count);
-       free(ih, M_DEVBUF, sizeof(*ih));
 
        if (TAILQ_EMPTY(&sc->sc_handler[ih->ih_irq])) {
                reg = HREAD4(sc, GPIO_PIN(ih->ih_irq));
@@ -397,6 +396,8 @@ aplpinctrl_intr_disestablish(void *cookie)
                HWRITE4(sc, GPIO_PIN(ih->ih_irq), reg);
        }
 
+       free(ih, M_DEVBUF, sizeof(*ih));
+
        splx(s);
 }