Sun bug 6811468: pci_device_solx_devfs_probe accesses freed memory
authorAlan Coopersmith <alan.coopersmith@sun.com>
Wed, 15 Apr 2009 17:06:49 +0000 (10:06 -0700)
committerAlan Coopersmith <alan.coopersmith@sun.com>
Wed, 15 Apr 2009 17:08:44 +0000 (10:08 -0700)
commitbe748a7b512bf5597e162694a3b1769132938fe1
treeb429c8cc6074c0c9446376c758ff4ab26f139c05
parentc56da48ee806f73c8ed81afb4a251b24de304620
Sun bug 6811468: pci_device_solx_devfs_probe accesses freed memory

di_fini() is being called in pci_device_solx_devfs_probe()
The di_fini (3DEVINFO) man page says "All  handles associated with this
snapshot become invalid after the  call to di_fini()".  But after that,
eight lines down, the subroutine was calling di_prop_lookup_ints with
a handle args.node which was stored from walking the device tree, and
then using the pointers that returned even further down.

Signed-off-by: Alan Coopersmith <alan.coopersmith@sun.com>
src/solx_devfs.c