From 5f9e5b5e62cd698d643794f2356af6021c8b05f7 Mon Sep 17 00:00:00 2001 From: Hans Petter Selasky Date: Tue, 9 Aug 2016 07:43:15 +0000 Subject: [PATCH] Fix for use after free. Clear the device description to avoid use after free because the bsddev is not destroyed when the mlx5en module is unloaded. Only when the parent mlx5 module is unloaded the bsddev is destroyed. This fixes a panic on listing sysctls which refer strings in the bsddev after the mlx5en module has been unloaded. Sponsored by: Mellanox Technologies MFC after: 1 week --- sys/dev/mlx5/mlx5_en/mlx5_en_main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c index 47d96b44534..2136567d2e1 100644 --- a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c +++ b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c @@ -3108,6 +3108,13 @@ mlx5e_destroy_ifp(struct mlx5_core_dev *mdev, void *vpriv) /* don't allow more IOCTLs */ priv->gone = 1; + /* + * Clear the device description to avoid use after free, + * because the bsddev is not destroyed when this module is + * unloaded: + */ + device_set_desc(mdev->pdev->dev.bsddev, NULL); + /* XXX wait a bit to allow IOCTL handlers to complete */ pause("W", hz);