From owner-svn-src-all@freebsd.org Mon Aug 15 09:09:02 2016 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E29B2BBA43B; Mon, 15 Aug 2016 09:09:02 +0000 (UTC) (envelope-from hselasky@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id B23D41833; Mon, 15 Aug 2016 09:09:02 +0000 (UTC) (envelope-from hselasky@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u7F991uw061547; Mon, 15 Aug 2016 09:09:01 GMT (envelope-from hselasky@FreeBSD.org) Received: (from hselasky@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u7F991Yk061546; Mon, 15 Aug 2016 09:09:01 GMT (envelope-from hselasky@FreeBSD.org) Message-Id: <201608150909.u7F991Yk061546@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: hselasky set sender to hselasky@FreeBSD.org using -f From: Hans Petter Selasky Date: Mon, 15 Aug 2016 09:09:01 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r304134 - stable/10/sys/dev/mlx5/mlx5_en X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Aug 2016 09:09:03 -0000 Author: hselasky Date: Mon Aug 15 09:09:01 2016 New Revision: 304134 URL: https://svnweb.freebsd.org/changeset/base/304134 Log: MFC r303870: Fix for use after free. Clear the device description to avoid use after free because the bsddev is not destroyed when the mlx5en module is unloaded. Only when the parent mlx5 module is unloaded the bsddev is destroyed. This fixes a panic on listing sysctls which refer strings in the bsddev after the mlx5en module has been unloaded. Sponsored by: Mellanox Technologies Modified: stable/10/sys/dev/mlx5/mlx5_en/mlx5_en_main.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/dev/mlx5/mlx5_en/mlx5_en_main.c ============================================================================== --- stable/10/sys/dev/mlx5/mlx5_en/mlx5_en_main.c Mon Aug 15 09:07:26 2016 (r304133) +++ stable/10/sys/dev/mlx5/mlx5_en/mlx5_en_main.c Mon Aug 15 09:09:01 2016 (r304134) @@ -3114,6 +3114,13 @@ mlx5e_destroy_ifp(struct mlx5_core_dev * /* don't allow more IOCTLs */ priv->gone = 1; + /* + * Clear the device description to avoid use after free, + * because the bsddev is not destroyed when this module is + * unloaded: + */ + device_set_desc(mdev->pdev->dev.bsddev, NULL); + /* XXX wait a bit to allow IOCTL handlers to complete */ pause("W", hz);