htl: Clear kernel_thread field before releasing the thread structure

Otherwise this is a use-after-free.

diff --git a/sysdeps/mach/htl/pt-thread-terminate.c b/sysdeps/mach/htl/pt-thread-terminate.c
index 0cf72b330f3512b0c68ec3b0279c5b516398e0a8..9bd6c3434d083d13d6092f3c02d9a4a948963533 100644 (file)
--- a/sysdeps/mach/htl/pt-thread-terminate.c
+++ b/sysdeps/mach/htl/pt-thread-terminate.c
@@ -62,15 +62,15 @@ __pthread_thread_terminate (struct __pthread *thread)
       ? __mig_get_reply_port () : MACH_PORT_NULL;
   __mach_port_deallocate (__mach_task_self (), self_ktid);
 
+  /* The kernel thread won't be there any more.  */
+  thread->kernel_thread = MACH_PORT_DEAD;
+
   /* Finally done with the thread structure.  */
   __pthread_dealloc (thread);
 
   /* The wake up port is now no longer needed.  */
   __mach_port_destroy (__mach_task_self (), wakeup_port);
 
-  /* The kernel thread won't be there any more.  */
-  thread->kernel_thread = MACH_PORT_DEAD;
-
   /* Terminate and release all that's left.  */
   err = __thread_terminate_release (kernel_thread, mach_task_self (),
                                    kernel_thread, reply_port,