From: jsg <jsg@openbsd.org>
Date: Thu, 23 Mar 2023 11:40:42 +0000 (+0000)
Subject: avoid use after free
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=614d6eea041df3166a04a522c3bce3b17d2bc5e3;p=openbsd

avoid use after free
ok miod@ kettenis@
---

diff --git a/sys/arch/arm64/dev/aplpinctrl.c b/sys/arch/arm64/dev/aplpinctrl.c
index e2145b04482..e6c680cd016 100644
--- a/sys/arch/arm64/dev/aplpinctrl.c
+++ b/sys/arch/arm64/dev/aplpinctrl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aplpinctrl.c,v 1.6 2023/03/05 14:45:07 patrick Exp $	*/
+/*	$OpenBSD: aplpinctrl.c,v 1.7 2023/03/23 11:40:42 jsg Exp $	*/
 /*
  * Copyright (c) 2021 Mark Kettenis <kettenis@openbsd.org>
  *
@@ -388,7 +388,6 @@ aplpinctrl_intr_disestablish(void *cookie)
 	TAILQ_REMOVE(&sc->sc_handler[ih->ih_irq], ih, ih_list);
 	if (ih->ih_name)
 		evcount_detach(&ih->ih_count);
-	free(ih, M_DEVBUF, sizeof(*ih));
 
 	if (TAILQ_EMPTY(&sc->sc_handler[ih->ih_irq])) {
 		reg = HREAD4(sc, GPIO_PIN(ih->ih_irq));
@@ -397,6 +396,8 @@ aplpinctrl_intr_disestablish(void *cookie)
 		HWRITE4(sc, GPIO_PIN(ih->ih_irq), reg);
 	}
 
+	free(ih, M_DEVBUF, sizeof(*ih));
+
 	splx(s);
 }