From: ratchov <ratchov@openbsd.org>
Date: Tue, 2 Feb 2021 11:18:57 +0000 (+0000)
Subject: Fix use-after-free in dev_abort()
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=ce71fe154a8115405e11f057838e87d07748a7d8;p=openbsd

Fix use-after-free in dev_abort()

Fixes crash that can occur when an usb device is unplugged, found by edd@
---

diff --git a/usr.bin/sndiod/dev.c b/usr.bin/sndiod/dev.c
index 176e8b17e79..6e2e1a6fa6e 100644
--- a/usr.bin/sndiod/dev.c
+++ b/usr.bin/sndiod/dev.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dev.c,v 1.89 2021/01/29 11:38:23 ratchov Exp $	*/
+/*	$OpenBSD: dev.c,v 1.90 2021/02/02 11:18:57 ratchov Exp $	*/
 /*
  * Copyright (c) 2008-2012 Alexandre Ratchov <alex@caoua.org>
  *
@@ -1281,12 +1281,12 @@ dev_abort(struct dev *d)
 	d->slot_list = NULL;
 
 	for (c = ctlslot_array, i = DEV_NCTLSLOT; i > 0; i--, c++) {
+		if (c->ops == NULL)
+			continue;
 		if (c->opt->dev != d)
 			continue;
-		if (c->ops) {
-			c->ops->exit(c->arg);
-			c->ops = NULL;
-		}
+		c->ops->exit(c->arg);
+		c->ops = NULL;
 	}
 
 	midi_abort(d->midi);