upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-08 16:22:46 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

g_dev_orphan(): Return early if the device is already gone

Browse source 
The following panic was the result of running "cdcontrol eject" after
using the physical ejection key on the device before the tray was
actually ejected. So we have hardware racing software.

The device was loaded with a DVD.

Resulted in a NULL pointer dereference

g_dev_orphan() at g_dev_orphan+0x2e/frame 0xfffffe01eba0a9f0
g_resize_provider_event() at g_resize_provider_event+0x71/frame 0xfffffe01eba0aa20
g_run_events() at g_run_events+0x20e/frame 0xfffffe01eba0aa70
fork_exit() at fork_exit+0x85/frame 0xfffffe01eba0aab0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe01eba0aab0

Avoid this possibility and return early of dev is NULL already.

PR:  215856
Reviewed by: imp (I've triggered this once or twice over the years too)
Sponsored by: Netflix
This commit is contained in:
Fabian Keil 2025-03-13 17:13:46 -06:00 committed by Warner Losh
parent 732c168842
commit f7856fe81d
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
sys/geom/geom_dev.c
View file

@ -853,6 +853,9 @@ g_dev_orphan(struct g_consumer *cp)
dev = sc->sc_dev;
g_trace(G_T_TOPOLOGY, "g_dev_orphan(%p(%s))", cp, cp->geom->name);
if (dev == NULL)
return;
/* Reset any dump-area set on this device */
if (dev->si_flags & SI_DUMPDEV) {
struct diocskerneldump_arg kda;