From nobody Sun Dec 01 04:58:05 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Y1F6Q2msRz5gDHv; Sun, 01 Dec 2024 04:58:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Y1F6P64WQz4Cxq; Sun, 1 Dec 2024 04:58:05 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1733029085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ord4ELq/AXE2bUwVhbF/w747VCqG7KO9Umetq1wL/o0=; b=iMLAHi1A/GU8xXoy5ZF68O2WI/sbSysi13oU/HS242ci6ja28viJaSD9KnnjniBTlVbYU2 8Elp1nwDS75Vj3mpwjh9Wm029ezn/PMGD1SHWTNbStNQR6ql6vX+oXRF06zDmben3oRyvD VPgv7hE1+UJ+z3jLs1sB1JHvkDy8YJ6TR/hw4d5eD0T0vwHQ7Ex0ly3XfuhobHxxVSaa/k NzyDCkKNXJWRFYq3GS2/n6yA+qE8XJzv+Jkn+BylM0DmUaBKdZkrvvWvu4jwaaZPc6WGxz EY6RvDo4lKo9bo9b5TGyZmPk7BRPw2smpDRfDAkgFfyQwkUADJ81y34ZPiGcNg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1733029085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ord4ELq/AXE2bUwVhbF/w747VCqG7KO9Umetq1wL/o0=; b=oqS71Jt/AibvF1hrYZV0/wV7zIL1gBVrZrrhmL5cqwaz/GtGcSK19qoLpbN7PZHXS0uSOY cUXc5CjE2tNnILIPjOq7bwrtf8mKgOv51EcCjD0z6A8JnMZrBN6Y7ojmBPer6O58UGOUKo v098u3jEISh05OvSMgXK4XjGYGZNGpwR6RASWhCEL+fa+jaIAkg5ZYrwyCcIaG1UoR8TOz k9LInwzUddzIHq3bMQC2SAcb1ZYJ5TGvQulMMh60154xavapRxQH+36DWSKoZ5WDL6hSYM QHEJHEdRBxM0bye6Q1chvNza5eOH4RNvHEVVeVSwFwwf+7byqxpZ3y8S0CUAPQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1733029085; a=rsa-sha256; cv=none; b=oUCbNOZeEk8NpQEQdrJ4w2lq5+oF/2s0uHjMvTNdTE0XdG8dPzf4pCpdPUxC6VxnF0VcTy cLmIvWhuynt0j08p70Xx5ypFyJmPpEKs3BFncYCkI8GxDFK/A9DdG2NddEKhk+loFuoN/S qG3w5QfEDj8l0iMQBV1RUACGEckGys4tz5fLlhkUNsYk7sVGMVNgNDkrEZMsmgg82lYRDZ pJVrtx+kl85wwmH34jIS0Kf2HwBjSKPuXp8ScEVX95p1+7I3q1aEbsfhb3lHeJvJR3Cgh8 M5aVCUcoHX8IgpqJIab0vDBgwlaAySyNAsLMP+YqNg2ArAPEdMqmeSFmbOgjiA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Y1F6P5dYyzf7Z; Sun, 1 Dec 2024 04:58:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4B14w54X097855; Sun, 1 Dec 2024 04:58:05 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4B14w5iN097852; Sun, 1 Dec 2024 04:58:05 GMT (envelope-from git) Date: Sun, 1 Dec 2024 04:58:05 GMT Message-Id: <202412010458.4B14w5iN097852@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: John Baldwin Subject: git: 7f77a2883ffb - stable/13 - miibus: Use a bus_child_deleted method to free ivars for children List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhb X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 7f77a2883ffb9d57d21d854e4b92754504951025 Auto-Submitted: auto-generated The branch stable/13 has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=7f77a2883ffb9d57d21d854e4b92754504951025 commit 7f77a2883ffb9d57d21d854e4b92754504951025 Author: John Baldwin AuthorDate: 2024-11-01 14:10:01 +0000 Commit: John Baldwin CommitDate: 2024-11-30 21:45:29 +0000 miibus: Use a bus_child_deleted method to free ivars for children If a device was detached (e.g. via devctl) and then re-attached, the ivars would be freed by the previous bus_child_detached method during detach, but device_get_ivars during the subsequent attach would return a stale pointer resulting in a use after free. Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D47371 (cherry picked from commit dc569c894207a524b0cb542040b35b0edd57d1c8) --- sys/dev/mii/mii.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/dev/mii/mii.c b/sys/dev/mii/mii.c index 5db0fd877a5c..de7b908b3d2d 100644 --- a/sys/dev/mii/mii.c +++ b/sys/dev/mii/mii.c @@ -57,7 +57,7 @@ MODULE_VERSION(miibus, 1); #include "miibus_if.h" -static bus_child_detached_t miibus_child_detached; +static bus_child_deleted_t miibus_child_deleted; static bus_child_location_str_t miibus_child_location_str; static bus_child_pnpinfo_str_t miibus_child_pnpinfo_str; static device_detach_t miibus_detach; @@ -83,7 +83,7 @@ static device_method_t miibus_methods[] = { /* bus interface */ DEVMETHOD(bus_print_child, miibus_print_child), DEVMETHOD(bus_read_ivar, miibus_read_ivar), - DEVMETHOD(bus_child_detached, miibus_child_detached), + DEVMETHOD(bus_child_deleted, miibus_child_deleted), DEVMETHOD(bus_child_pnpinfo_str, miibus_child_pnpinfo_str), DEVMETHOD(bus_child_location_str, miibus_child_location_str), DEVMETHOD(bus_hinted_child, miibus_hinted_child), @@ -167,7 +167,7 @@ miibus_detach(device_t dev) } static void -miibus_child_detached(device_t dev, device_t child) +miibus_child_deleted(device_t dev, device_t child) { struct mii_attach_args *args;