d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix for use-after-free by if_ioctl() calls from user-space in USB drivers by

Browse Source 
detaching the ifnet before the miibus.

PR:		252608
Suggested by:	jhb@
MFC after:	1 week
Sponsored by:	Mellanox Technologies // NVIDIA Networking
This commit is contained in:
Hans Petter Selasky 2021-01-12 18:51:09 +01:00
parent b764a42653
commit 4eac63af23
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/dev/usb/net/uhso.c
View File

@ -691,10 +691,10 @@ uhso_detach(device_t self)
free_unr(uhso_ifnet_unit, sc->sc_ifp->if_dunit);
mtx_lock(&sc->sc_mtx);
uhso_if_stop(sc);
mtx_unlock(&sc->sc_mtx);
bpfdetach(sc->sc_ifp);
if_detach(sc->sc_ifp);
if_free(sc->sc_ifp);
mtx_unlock(&sc->sc_mtx);
usbd_transfer_unsetup(sc->sc_if_xfer, UHSO_IFNET_MAX);
}

9
sys/dev/usb/net/usb_ethernet.c
View File

@ -319,6 +319,12 @@ uether_ifdetach(struct usb_ether *ue)
/* drain any callouts */
usb_callout_drain(&ue->ue_watchdog);
/*
* Detach ethernet first to stop miibus calls from
* user-space:
*/
ether_ifdetach(ifp);
/* detach miibus */
if (ue->ue_miibus != NULL) {
mtx_lock(&Giant); /* device_xxx() depends on this */
@ -326,9 +332,6 @@ uether_ifdetach(struct usb_ether *ue)
mtx_unlock(&Giant);
}
/* detach ethernet */
ether_ifdetach(ifp);
/* free interface instance */
if_free(ifp);