From nobody Sun Dec 01 04:57:16 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Y1F5T1Jfkz5gD68; Sun, 01 Dec 2024 04:57:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Y1F5S6mMFz49cZ; Sun, 1 Dec 2024 04:57:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1733029036; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cqiEXCH8h6qEdYclJvosO9Ikw79NCozHuDZfHzFjTZk=; b=aVdlvXJVQ7/34hNeg4rILqaFXnBl8iSKp273dmDEGo5z7Yjeogwgskdd8YTBZcyzA884tF 8CJR3Vf9/se9M9ju8AHzBKGUlVYMDiIvxFlxOGqMAsRUYeEoknzaRkktVO1MopS4jFPEhj 0UFRelxRZDCQIAP070DnTsSUGWZrwVxnF1ejNTkMO89tA9m7Ul/oDtdHQNZQboMN3klD7+ hcpPjmMF2AZz/HHYtmJhWtgHftJ73PUBLaJO3hC5JQQcYKetGI+mr8zz/do1FjVQwA9zK3 9R+JJp+5kyt1rQvlL6XqS3kSVrjvmkhgQNsTk29rwQelCTnWCsKzS2EMhoDKYA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1733029036; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cqiEXCH8h6qEdYclJvosO9Ikw79NCozHuDZfHzFjTZk=; b=IMrejYqYR60XgnO661/Y6CJmSsJGqzIWbB6QGzzWim6kd7k/CRMorZg4AM2jLvBWQpCC5A TFJtPZaQ9/kdrSm8feFZ78Iu3zFdTGExYR321lMIRZhsyFtvsSnHH/gQN6LMmPOIK5M0pO vC4qbppDkf0D4nZGEuxH6Nz4vJXpsoEZG8YFEd1GVIKN6eniQvXn0HfR41tu6CDutrGBbi efJENpLbKac0VI9ozdAJinzHJ9z2P5hiyuzH2Xi4kYGJfxFdSIalI92VRPxCNALleXOkuh 1yfGHnuJE3+U1H6wmV95E8qlJyxI2xIFIMw10reJEs5XTLEJWRhFJattKqiaxg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1733029036; a=rsa-sha256; cv=none; b=NaHZbzSH/Hw6+BDDaCX9Sup9sMMAMKq7bG4yMMc/MF8/a+/gDkK8pZQN2B9Nlheg+NHX2J sFEqxecysPlpE+vg44pf2zPrkObKqU7RVnuDqWxGljNk0ZtRIOfTQrsR22noChlQg5M+rn nPq+oaIZUvrBXYMwDIC06fQvRD/ylpJr73oYUwl+dPmdE+XjAKQOqeexku8Z1fn12IUdUy NRA/N7jQDdEEtXeLr7L2RF0O5/vP2356j55majK71YCVOA47UFWLs6QP355UYIIA5F7hXr UA3GYM2dyownmTxhleKXNOzOAmWthEFot8saiswyozyiJFW/3YBtfajZNH6uTQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Y1F5S6NdfzfQs; Sun, 1 Dec 2024 04:57:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4B14vGGb095502; Sun, 1 Dec 2024 04:57:16 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4B14vGZP095499; Sun, 1 Dec 2024 04:57:16 GMT (envelope-from git) Date: Sun, 1 Dec 2024 04:57:16 GMT Message-Id: <202412010457.4B14vGZP095499@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: John Baldwin Subject: git: 69cfc0c25d13 - stable/14 - miibus: Use a bus_child_deleted method to free ivars for children List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhb X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 69cfc0c25d131fc46617951a23f794032dd365d3 Auto-Submitted: auto-generated The branch stable/14 has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=69cfc0c25d131fc46617951a23f794032dd365d3 commit 69cfc0c25d131fc46617951a23f794032dd365d3 Author: John Baldwin AuthorDate: 2024-11-01 14:10:01 +0000 Commit: John Baldwin CommitDate: 2024-12-01 02:46:07 +0000 miibus: Use a bus_child_deleted method to free ivars for children If a device was detached (e.g. via devctl) and then re-attached, the ivars would be freed by the previous bus_child_detached method during detach, but device_get_ivars during the subsequent attach would return a stale pointer resulting in a use after free. Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D47371 (cherry picked from commit dc569c894207a524b0cb542040b35b0edd57d1c8) --- sys/dev/mii/mii.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/dev/mii/mii.c b/sys/dev/mii/mii.c index 83c8aafdf9fb..0ca779a9311f 100644 --- a/sys/dev/mii/mii.c +++ b/sys/dev/mii/mii.c @@ -58,7 +58,7 @@ MODULE_VERSION(miibus, 1); #include "miibus_if.h" -static bus_child_detached_t miibus_child_detached; +static bus_child_deleted_t miibus_child_deleted; static bus_child_location_t miibus_child_location; static bus_child_pnpinfo_t miibus_child_pnpinfo; static device_detach_t miibus_detach; @@ -84,7 +84,7 @@ static device_method_t miibus_methods[] = { /* bus interface */ DEVMETHOD(bus_print_child, miibus_print_child), DEVMETHOD(bus_read_ivar, miibus_read_ivar), - DEVMETHOD(bus_child_detached, miibus_child_detached), + DEVMETHOD(bus_child_deleted, miibus_child_deleted), DEVMETHOD(bus_child_pnpinfo, miibus_child_pnpinfo), DEVMETHOD(bus_child_location, miibus_child_location), DEVMETHOD(bus_hinted_child, miibus_hinted_child), @@ -167,7 +167,7 @@ miibus_detach(device_t dev) } static void -miibus_child_detached(device_t dev, device_t child) +miibus_child_deleted(device_t dev, device_t child) { struct mii_attach_args *args;