From owner-svn-src-head@freebsd.org  Sat Aug 15 09:00:37 2015
Return-Path: <owner-svn-src-head@freebsd.org>
Delivered-To: svn-src-head@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 97BAE9B9094;
 Sat, 15 Aug 2015 09:00:37 +0000 (UTC)
 (envelope-from hselasky@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 7BB451BF8;
 Sat, 15 Aug 2015 09:00:37 +0000 (UTC)
 (envelope-from hselasky@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.70])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id t7F90bHv063806;
 Sat, 15 Aug 2015 09:00:37 GMT (envelope-from hselasky@FreeBSD.org)
Received: (from hselasky@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id t7F90bm4063804;
 Sat, 15 Aug 2015 09:00:37 GMT (envelope-from hselasky@FreeBSD.org)
Message-Id: <201508150900.t7F90bm4063804@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: hselasky set sender to
 hselasky@FreeBSD.org using -f
From: Hans Petter Selasky <hselasky@FreeBSD.org>
Date: Sat, 15 Aug 2015 09:00:37 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r286799 - head/sys/dev/usb
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 15 Aug 2015 09:00:37 -0000

Author: hselasky
Date: Sat Aug 15 09:00:36 2015
New Revision: 286799
URL: https://svnweb.freebsd.org/changeset/base/286799

Log:
  Fix race in USB PF which can happen if we stop tracing exactly when
  the kernel is tapping an USB transfer. This leads to a NULL pointer
  access. The solution is to only trace while the USB bus lock is
  locked.
  
  MFC after:	2 weeks

Modified:
  head/sys/dev/usb/usb_pf.c
  head/sys/dev/usb/usb_transfer.c

Modified: head/sys/dev/usb/usb_pf.c
==============================================================================
--- head/sys/dev/usb/usb_pf.c	Sat Aug 15 08:42:33 2015	(r286798)
+++ head/sys/dev/usb/usb_pf.c	Sat Aug 15 09:00:36 2015	(r286799)
@@ -221,7 +221,13 @@ usbpf_clone_destroy(struct if_clone *ifc
 	ubus = ifp->if_softc;
 	unit = ifp->if_dunit;
 
+	/*
+	 * Lock USB before clearing the "ifp" pointer, to avoid
+	 * clearing the pointer in the middle of a TAP operation:
+	 */
+	USB_BUS_LOCK(ubus);
 	ubus->ifp = NULL;
+	USB_BUS_UNLOCK(ubus);
 	bpfdetach(ifp);
 	if_detach(ifp);
 	if_free(ifp);

Modified: head/sys/dev/usb/usb_transfer.c
==============================================================================
--- head/sys/dev/usb/usb_transfer.c	Sat Aug 15 08:42:33 2015	(r286798)
+++ head/sys/dev/usb/usb_transfer.c	Sat Aug 15 09:00:36 2015	(r286799)
@@ -2398,8 +2398,11 @@ usbd_callback_wrapper(struct usb_xfer_qu
 	}
 
 #if USB_HAVE_PF
-	if (xfer->usb_state != USB_ST_SETUP)
+	if (xfer->usb_state != USB_ST_SETUP) {
+		USB_BUS_LOCK(info->bus);
 		usbpf_xfertap(xfer, USBPF_XFERTAP_DONE);
+		USB_BUS_UNLOCK(info->bus);
+	}
 #endif
 	/* call processing routine */
 	(xfer->callback) (xfer, xfer->error);