diff options
| author | Xuqing Yang <rigelyoung@icloud.com> | 2026-08-18 20:17:44 +0000 |
|---|---|---|
| committer | Christos Margiolis <christos@FreeBSD.org> | 2026-08-18 20:18:01 +0000 |
| commit | 95c04b25323d59da43203a08e56db141ac37181b (patch) | |
| tree | 5fc4dfe8e7632072150e14d82dc73b1537b1dda5 /contrib/llvm-project/llvm/lib/DebugInfo/PDB/Native/(public-mirror) | |
| parent | 644990f193cc284db241125e567519cafa1c7ccd (diff) | |
bcm2835_audio_release() calls vchi_service_close() and then
unconditionally calls vchi_service_release() with the same service
handle.
In the VCHI shim implementation, a successful vchi_service_close() calls
service_free(service). The subsequent vchi_service_release() therefore
dereferences a freed SHIM_SERVICE_T object when it reads
service->handle, resulting in a use-after-free panic.
vchi_service_release(), however, releases a reference which might block
vchi_service_close() from completing successfuly, so comment it out
instead of removing it altogether, until further testing is done.
PR: 297187
MFC after: 2 weeks
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D58921
Diffstat (limited to 'contrib/llvm-project/llvm/lib/DebugInfo/PDB/Native/(public-mirror)')
0 files changed, 0 insertions, 0 deletions