OpenBSD/src xKWl0VIsys/dev/wscons wsmux.c

   A problem fixed in wskbd is also present in wsmux. Repeating the
   previous commit message:

   In wsmuxclose(), use the same logic as in wsmuxopen() to determine if
   the device was opened in write-only mode. Relying on me_evar being NULL
   does not work if the wsmux device was opened first followed attaching it
   to another wsmux. Closing the wsmux device first at this stage would
   cause the wscons_event queue inherited from the parent wsmux to be
   freed. This in turn could cause a panic if an ioctl(WSMUXIO_INJECTEVENT)
   command is issued on parent wsmux device.

   ok mpi@ visa@

   Reported-by: syzbot+f6c2ed7901eb4b970720 at syzkaller.appspotmail.com
VersionDeltaFile
1.46+2-2sys/dev/wscons/wsmux.c
+2-21 files

UnifiedSplitRaw