Date: Mon, 31 Jul 2023 12:56:27 GMT From: Marcin Wojtas <mw@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: b390fe1d806a - stable/12 - ena: Fix driver unload crash Message-ID: <202307311256.36VCuRn2093348@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by mw: URL: https://cgit.FreeBSD.org/src/commit/?id=b390fe1d806a56ee8c8b6d57c7d47ca288f20337 commit b390fe1d806a56ee8c8b6d57c7d47ca288f20337 Author: Arthur Kiyanovski <akiyano@amazon.com> AuthorDate: 2023-05-21 12:31:54 +0000 Commit: Marcin Wojtas <mw@FreeBSD.org> CommitDate: 2023-07-31 12:49:58 +0000 ena: Fix driver unload crash When ena_detach is called, we first call ether_ifdetach(), which destroys internal addresses of ifp. One such address is ifp->if_addr->ifa_addr. Then during ena_destroy_device(), if_link_state_change() is called, eventually trying to access ifp->if_addr->ifa_addr->sa_family. This causes an access to garbage memory and crashes the kernel. Ticket [1] was opened to the FreeBSD community to add null check in the code of if_link_state_change(). A fix was submitted in commit [2], however it was noted that it is our driver's responsibilty to not call if_link_state_change() after calling ether_ifdetach(). This commit makes sure if_link_state_change() is not called after ether_ifdetach(). [1]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270813 [2]: https://reviews.freebsd.org/D39614 Fixes: 32f63fa7f975 ("Split ENA reset routine into restore and destroy stages") MFC after: 2 weeks Sponsored by: Amazon, Inc. (cherry picked from commit c59a5fbd8a2ef68ed0842cbb1df4450edd654129) --- sys/dev/ena/ena.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sys/dev/ena/ena.c b/sys/dev/ena/ena.c index c8c12593fcd1..b157be9ada88 100644 --- a/sys/dev/ena/ena.c +++ b/sys/dev/ena/ena.c @@ -3296,7 +3296,8 @@ ena_destroy_device(struct ena_adapter *adapter, bool graceful) if (!ENA_FLAG_ISSET(ENA_FLAG_DEVICE_RUNNING, adapter)) return; - if_link_state_change(ifp, LINK_STATE_DOWN); + if (!graceful) + if_link_state_change(ifp, LINK_STATE_DOWN); ENA_TIMER_DRAIN(adapter);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202307311256.36VCuRn2093348>