From fc51d58e6237f46bbca99157a1fe7bbf62e57cc0 Mon Sep 17 00:00:00 2001
From: Peter Wemm <peter@FreeBSD.org>
Date: Sun, 25 Apr 1999 22:13:34 +0000
Subject: Fix a very long standing bug in run_interrupt_driven_config_hooks(). 
 It was fetching the next pointer from memory that could have been free()'d.

---
 sys/kern/subr_autoconf.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'sys/kern/subr_autoconf.c')

diff --git a/sys/kern/subr_autoconf.c b/sys/kern/subr_autoconf.c
index 2199134d060d..3e90dc5a5031 100644
--- a/sys/kern/subr_autoconf.c
+++ b/sys/kern/subr_autoconf.c
@@ -41,7 +41,7 @@
  *
  *	@(#)subr_autoconf.c	8.1 (Berkeley) 6/10/93
  *
- * $Id: subr_autoconf.c,v 1.9 1999/04/17 08:36:04 peter Exp $
+ * $Id: subr_autoconf.c,v 1.10 1999/04/17 09:12:35 peter Exp $
  */
 
 #include <sys/param.h>
@@ -66,10 +66,11 @@ static void
 run_interrupt_driven_config_hooks(dummy)
 	void *dummy;
 {
-	struct intr_config_hook *hook;
+	struct intr_config_hook *hook, *next;
 
 	for (hook = intr_config_hook_list.tqh_first; hook != NULL;
-	     hook = hook->ich_links.tqe_next) {
+	     hook = next) {
+		next = hook->ich_links.tqe_next;
 		(*hook->ich_func)(hook->ich_arg);
 	}
 
-- 
cgit v1.2.3