Date: Tue, 12 Jan 2021 17:17:21 +0000 From: bugzilla-noreply@freebsd.org To: usb@FreeBSD.org Subject: [Bug 252608] [panic] [usb] [if_ure] Kernel fault on ure disconnect Message-ID: <bug-252608-19105-1s0Td4s3Ic@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-252608-19105@https.bugs.freebsd.org/bugzilla/> References: <bug-252608-19105@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D252608 --- Comment #7 from Ali Abdallah <ali.abdallah@suse.com> --- It crashes as well with the patch from comment 5 --- trap 0xc, rip =3D 0xffffffff803b28f1, rsp =3D 0xfffffe00c83604c0, rbp = =3D 0xfffffe00c8360540 ---=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20 __mtx_lock_sleep() at __mtx_lock_sleep+0xd1/frame 0xfffffe00c8360540=20=20= =20=20=20=20=20=20=20=20=20=20 usbd_do_request_flags() at usbd_do_request_flags+0x740/frame 0xfffffe00c836= 05d0=20 usbd_do_request_proc() at usbd_do_request_proc+0x60/frame 0xfffffe00c836063= 0=20=20=20=20 ure_miibus_readreg() at ure_miibus_readreg+0x11c/frame 0xfffffe00c83606a0= =20=20=20=20=20=20=20 rgephy_status() at rgephy_status+0x80/frame 0xfffffe00c83606f0=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20 rgephy_service() at rgephy_service+0x417/frame 0xfffffe00c8360750=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20 mii_pollstat() at mii_pollstat+0x46/frame 0xfffffe00c8360780=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20 ure_ifmedia_sts() at ure_ifmedia_sts+0x41/frame 0xfffffe00c83607b0=20=20=20= =20=20=20=20=20=20=20=20=20=20=20 ifmedia_ioctl() at ifmedia_ioctl+0x16a/frame 0xfffffe00c83607e0=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20 ifhwioctl() at ifhwioctl+0x2af/frame 0xfffffe00c83608e0=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20 ifioctl() at ifioctl+0x2eb/frame 0xfffffe00c8360990=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20 kern_ioctl() at kern_ioctl+0x26d/frame 0xfffffe00c8360a00=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20 sys_ioctl() at sys_ioctl+0xf2/frame 0xfffffe00c8360ac0 Use after free of the if_ure mutex. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-252608-19105-1s0Td4s3Ic>