The branch main has been updated by hselasky:
URL:
https://cgit.FreeBSD.org/src/commit/?id=4eac63af23ddafc2b1dfb2aad2896f4513c37cdd
commit 4eac63af23ddafc2b1dfb2aad2896f4513c37cdd
Author: Hans Petter Selasky <hsela...@freebsd.org>
AuthorDate: 2021-01-12 17:51:09 +0000
Commit: Hans Petter Selasky <hsela...@freebsd.org>
CommitDate: 2021-05-21 12:59:19 +0000
Fix for use-after-free by if_ioctl() calls from user-space in USB drivers by
detaching the ifnet before the miibus.
PR: 252608
Suggested by: jhb@
MFC after: 1 week
Sponsored by: Mellanox Technologies // NVIDIA Networking
---
sys/dev/usb/net/uhso.c | 2 +-
sys/dev/usb/net/usb_ethernet.c | 9 ++++++---
2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/sys/dev/usb/net/uhso.c b/sys/dev/usb/net/uhso.c
index c72fa8d7a36b..4ff5fcc075d3 100644
--- a/sys/dev/usb/net/uhso.c
+++ b/sys/dev/usb/net/uhso.c
@@ -691,10 +691,10 @@ uhso_detach(device_t self)
free_unr(uhso_ifnet_unit, sc->sc_ifp->if_dunit);
mtx_lock(&sc->sc_mtx);
uhso_if_stop(sc);
+ mtx_unlock(&sc->sc_mtx);
bpfdetach(sc->sc_ifp);
if_detach(sc->sc_ifp);
if_free(sc->sc_ifp);
- mtx_unlock(&sc->sc_mtx);
usbd_transfer_unsetup(sc->sc_if_xfer, UHSO_IFNET_MAX);
}
diff --git a/sys/dev/usb/net/usb_ethernet.c b/sys/dev/usb/net/usb_ethernet.c
index e1eb2c247b5a..33659049f970 100644
--- a/sys/dev/usb/net/usb_ethernet.c
+++ b/sys/dev/usb/net/usb_ethernet.c
@@ -319,6 +319,12 @@ uether_ifdetach(struct usb_ether *ue)
/* drain any callouts */
usb_callout_drain(&ue->ue_watchdog);
+ /*
+ * Detach ethernet first to stop miibus calls from
+ * user-space:
+ */
+ ether_ifdetach(ifp);
+
/* detach miibus */
if (ue->ue_miibus != NULL) {
mtx_lock(&Giant); /* device_xxx() depends on this
*/
@@ -326,9 +332,6 @@ uether_ifdetach(struct usb_ether *ue)
mtx_unlock(&Giant);
}
- /* detach ethernet */
- ether_ifdetach(ifp);
-
/* free interface instance */
if_free(ifp);
_______________________________________________
dev-commits-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all
To unsubscribe, send any mail to "dev-commits-src-all-unsubscr...@freebsd.org"
