git: eff0170df142 - stable/13 - ena: Fix driver unload crash

The branch stable/13 has been updated by mw:

URL: https://cgit.FreeBSD.org/src/commit/?id=eff0170df142f973d684e2180beca744a1a88e8c

commit eff0170df142f973d684e2180beca744a1a88e8c
Author:     Arthur Kiyanovski <akiyano@amazon.com>
AuthorDate: 2023-05-21 12:31:54 +0000
Commit:     Marcin Wojtas <mw@FreeBSD.org>
CommitDate: 2023-07-31 12:23:42 +0000

    ena: Fix driver unload crash
    
    When ena_detach is called, we first call ether_ifdetach(),
    which destroys internal addresses of ifp. One such address
    is ifp->if_addr->ifa_addr. Then during ena_destroy_device(),
    if_link_state_change() is called, eventually trying to access
    ifp->if_addr->ifa_addr->sa_family. This causes an access
    to garbage memory and crashes the kernel.
    
    Ticket [1] was opened to the FreeBSD community to add null
    check in the code of if_link_state_change().
    A fix was submitted in commit [2], however it was noted
    that it is our driver's responsibilty to not call
    if_link_state_change() after calling ether_ifdetach().
    
    This commit makes sure if_link_state_change() is not called
    after ether_ifdetach().
    
    [1]: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270813
    [2]: https://reviews.freebsd.org/D39614
    
    Fixes: 32f63fa7f975 ("Split ENA reset routine into restore and destroy stages")
    MFC after: 2 weeks
    Sponsored by: Amazon, Inc.
    
    (cherry picked from commit c59a5fbd8a2ef68ed0842cbb1df4450edd654129)
---
 sys/dev/ena/ena.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sys/dev/ena/ena.c b/sys/dev/ena/ena.c
index a974a20638b9..d787bb5f9493 100644
--- a/sys/dev/ena/ena.c
+++ b/sys/dev/ena/ena.c
@@ -3292,7 +3292,8 @@ ena_destroy_device(struct ena_adapter *adapter, bool graceful)
 	if (!ENA_FLAG_ISSET(ENA_FLAG_DEVICE_RUNNING, adapter))
 		return;
 
-	if_link_state_change(ifp, LINK_STATE_DOWN);
+	if (!graceful)
+		if_link_state_change(ifp, LINK_STATE_DOWN);
 
 	ENA_TIMER_DRAIN(adapter);