[Bug 297187] `bcm2835_audio_release()` Uses a Freed VCHI Service After Close

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297187

Christos Margiolis <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|New                         |In Progress

--- Comment #6 from Christos Margiolis <[email protected]> ---
Mark, the patch and the analysis looks good to me. vchi_service_close() casts
"handle" to "service":

SHIM_SERVICE_T *service = (SHIM_SERVICE_T *)handle;

And then if vchiq_close_service() succeeds, it frees "service", i.e., handle.
The fix seems correct even though I don't have the HW to test it.

-- 
You are receiving this mail because:
You are the assignee for the bug.