Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 3 Jul 2014 13:49:43 +0000 (UTC)
From:      Hans Petter Selasky <hselasky@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org
Subject:   svn commit: r268214 - in releng/9.3/sys/dev/usb: net serial
Message-ID:  <201407031349.s63Dnhqw067003@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: hselasky
Date: Thu Jul  3 13:49:43 2014
New Revision: 268214
URL: http://svnweb.freebsd.org/changeset/base/268214

Log:
  MFC r268078 and r268080:
  Fix for memory use after free() and mtx_destroy().
  
  Approved by:	re, glebius @

Modified:
  releng/9.3/sys/dev/usb/net/uhso.c
  releng/9.3/sys/dev/usb/serial/usb_serial.c
  releng/9.3/sys/dev/usb/serial/usb_serial.h
Directory Properties:
  releng/9.3/sys/   (props changed)

Modified: releng/9.3/sys/dev/usb/net/uhso.c
==============================================================================
--- releng/9.3/sys/dev/usb/net/uhso.c	Thu Jul  3 13:21:00 2014	(r268213)
+++ releng/9.3/sys/dev/usb/net/uhso.c	Thu Jul  3 13:49:43 2014	(r268214)
@@ -558,8 +558,6 @@ uhso_attach(device_t self)
 	mtx_init(&sc->sc_mtx, "uhso", NULL, MTX_DEF);
 	ucom_ref(&sc->sc_super_ucom);
 
-	sc->sc_ucom = NULL;
-	sc->sc_ttys = 0;
 	sc->sc_radio = 1;
 
 	id = usbd_get_interface_descriptor(uaa->iface);
@@ -679,9 +677,6 @@ uhso_detach(device_t self)
 				    UHSO_CTRL_MAX);
 			}
 		}
-
-		free(sc->sc_tty, M_USBDEV);
-		free(sc->sc_ucom, M_USBDEV);
 	}
 
 	if (sc->sc_ifp != NULL) {
@@ -709,6 +704,8 @@ static void
 uhso_free_softc(struct uhso_softc *sc)
 {
 	if (ucom_unref(&sc->sc_super_ucom)) {
+		free(sc->sc_tty, M_USBDEV);
+		free(sc->sc_ucom, M_USBDEV);
 		mtx_destroy(&sc->sc_mtx);
 		device_free_softc(sc);
 	}

Modified: releng/9.3/sys/dev/usb/serial/usb_serial.c
==============================================================================
--- releng/9.3/sys/dev/usb/serial/usb_serial.c	Thu Jul  3 13:21:00 2014	(r268213)
+++ releng/9.3/sys/dev/usb/serial/usb_serial.c	Thu Jul  3 13:49:43 2014	(r268214)
@@ -203,7 +203,7 @@ ucom_uninit(void *arg)
 
 	mtx_destroy(&ucom_mtx);
 }
-SYSUNINIT(ucom_uninit, SI_SUB_KLD - 2, SI_ORDER_ANY, ucom_uninit, NULL);
+SYSUNINIT(ucom_uninit, SI_SUB_KLD - 3, SI_ORDER_ANY, ucom_uninit, NULL);
 
 /*
  * Mark a unit number (the X in cuaUX) as in use.

Modified: releng/9.3/sys/dev/usb/serial/usb_serial.h
==============================================================================
--- releng/9.3/sys/dev/usb/serial/usb_serial.h	Thu Jul  3 13:21:00 2014	(r268213)
+++ releng/9.3/sys/dev/usb/serial/usb_serial.h	Thu Jul  3 13:49:43 2014	(r268214)
@@ -195,7 +195,7 @@ struct ucom_softc {
 #define	UCOM_MTX_LOCK(sc) mtx_lock((sc)->sc_mtx)
 #define	UCOM_MTX_UNLOCK(sc) mtx_unlock((sc)->sc_mtx)
 #define	UCOM_UNLOAD_DRAIN(x) \
-SYSUNINIT(var, SI_SUB_KLD - 3, SI_ORDER_ANY, ucom_drain_all, 0)
+SYSUNINIT(var, SI_SUB_KLD - 2, SI_ORDER_ANY, ucom_drain_all, 0)
 
 #define	ucom_cfg_do_request(udev,com,req,ptr,flags,timo) \
     usbd_do_request_proc(udev,&(com)->sc_super->sc_tq,req,ptr,flags,NULL,timo)

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201407031349.s63Dnhqw067003>