d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix race in USB PF which can happen if we stop tracing exactly when

Browse Source 
the kernel is tapping an USB transfer. This leads to a NULL pointer
access. The solution is to only trace while the USB bus lock is
locked.

MFC after:	2 weeks
This commit is contained in:
Hans Petter Selasky 2015-08-15 09:00:36 +00:00
parent c5b3acf218
commit 22ef3de712
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/dev/usb/usb_pf.c
View File

@ -221,7 +221,13 @@ usbpf_clone_destroy(struct if_clone *ifc, struct ifnet *ifp)
ubus = ifp->if_softc;
unit = ifp->if_dunit;
/*
* Lock USB before clearing the "ifp" pointer, to avoid
* clearing the pointer in the middle of a TAP operation:
*/
USB_BUS_LOCK(ubus);
ubus->ifp = NULL;
USB_BUS_UNLOCK(ubus);
bpfdetach(ifp);
if_detach(ifp);
if_free(ifp);

5
sys/dev/usb/usb_transfer.c
View File

@ -2398,8 +2398,11 @@ usbd_callback_wrapper(struct usb_xfer_queue *pq)
}
#if USB_HAVE_PF
if (xfer->usb_state != USB_ST_SETUP)
if (xfer->usb_state != USB_ST_SETUP) {
USB_BUS_LOCK(info->bus);
usbpf_xfertap(xfer, USBPF_XFERTAP_DONE);
USB_BUS_UNLOCK(info->bus);
}
#endif
/* call processing routine */
(xfer->callback) (xfer, xfer->error);