K 10
svn:author
V 4
will
K 8
svn:date
V 27
2013-04-08T23:16:42.567118Z
K 7
svn:log
V 578
FireWire: Don't allow a tlabel to reference an xfer after free.

sys/dev/firewire/firewire.c:
- fw_xfer_unload(): Since we are about to free this xfer, call fw_tl_free()
  to remove the xfer from its tlabel's list, if it has a tlabel.
- In every occasion when a xfer is removed from a tlabel's list, reset
  xfer->tl to -1 while holding fc->tlabel_lock, so that the xfer isn't
  mis-identified as belonging to a tlabel.

This doesn't fix all the use-after-free problems for M_FWMEM, but is an
incremental towards that goal.

Reviewed by:	kan, sbruno
Sponsored by:	Spectra Logic

END