d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed "Memory modified after free" panic in rl_detach() due

Browse Source 
to rl_stop() accessing already freed "struct ifnet".

Fixed LOR between rl mutex and some ACPI mutex in rl_detach().
This commit is contained in:
Ruslan Ermilov 2005-09-14 12:33:23 +00:00
parent febd1f4df1
commit 8d7a953fb2
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=150126
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/pci/if_rl.c
View File

@ -1017,15 +1017,15 @@ rl_detach(device_t dev)
attached = device_is_attached(dev);
/* These should only be active if attach succeeded */
if (attached) {
RL_LOCK(sc);
rl_stop(sc);
RL_UNLOCK(sc);
ether_ifdetach(ifp);
if_free(ifp);
}
RL_LOCK(sc);
#if 0
sc->suspended = 1;
#endif
if (attached)
rl_stop(sc);
if (sc->rl_miibus)
device_delete_child(dev, sc->rl_miibus);
bus_generic_detach(dev);
@ -1046,7 +1046,6 @@ rl_detach(device_t dev)
if (sc->rl_parent_tag)
bus_dma_tag_destroy(sc->rl_parent_tag);
RL_UNLOCK(sc);
mtx_destroy(&sc->rl_mtx);
return (0);