mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-06 13:09:50 +00:00
Code Issues Releases Activity

Fix for use after free.

Browse Source 
Clear the device description to avoid use after free because the
bsddev is not destroyed when the mlx5en module is unloaded. Only when
the parent mlx5 module is unloaded the bsddev is destroyed. This fixes
a panic on listing sysctls which refer strings in the bsddev after the
mlx5en module has been unloaded.

Sponsored by:	Mellanox Technologies
MFC after:	1 week
This commit is contained in:
Hans Petter Selasky 2016-08-09 07:43:15 +00:00
parent 96762fe314
commit 5f9e5b5e62
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=303870
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/dev/mlx5/mlx5_en/mlx5_en_main.c
View File

@ -3108,6 +3108,13 @@ mlx5e_destroy_ifp(struct mlx5_core_dev *mdev, void *vpriv)
/* don't allow more IOCTLs */
priv->gone = 1;
/*
* Clear the device description to avoid use after free,
* because the bsddev is not destroyed when this module is
* unloaded:
*/
device_set_desc(mdev->pdev->dev.bsddev, NULL);
/* XXX wait a bit to allow IOCTL handlers to complete */
pause("W", hz);