upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-08 16:22:46 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

ena: Fix driver unload crash

Browse source 
When ena_detach is called, we first call ether_ifdetach(),
which destroys internal addresses of ifp. One such address
is ifp->if_addr->ifa_addr. Then during ena_destroy_device(),
if_link_state_change() is called, eventually trying to access
ifp->if_addr->ifa_addr->sa_family. This causes an access
to garbage memory and crashes the kernel.

Ticket [1] was opened to the FreeBSD community to add null
check in the code of if_link_state_change().
A fix was submitted in commit [2], however it was noted
that it is our driver's responsibilty to not call
if_link_state_change() after calling ether_ifdetach().

This commit makes sure if_link_state_change() is not called
after ether_ifdetach().

[1]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270813
[2]: https://reviews.freebsd.org/D39614

Fixes: 32f63fa7f9 ("Split ENA reset routine into restore and destroy stages")
MFC after: 2 weeks
Sponsored by: Amazon, Inc.
This commit is contained in:
Arthur Kiyanovski 2023-05-21 12:31:54 +00:00 committed by Marcin Wojtas
parent b9e80b5280
commit c59a5fbd8a
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
sys/dev/ena/ena.c
View file

@ -3291,7 +3291,8 @@ ena_destroy_device(struct ena_adapter *adapter, bool graceful)
if (!ENA_FLAG_ISSET(ENA_FLAG_DEVICE_RUNNING, adapter))
return;
if_link_state_change(ifp, LINK_STATE_DOWN);
if (!graceful)
if_link_state_change(ifp, LINK_STATE_DOWN);
ENA_TIMER_DRAIN(adapter);