git: 4eac63af23dd - main - Fix for use-after-free by if_ioctl() calls from user-space in USB drivers by detaching the ifnet before the miibus.

[Hans Petter Selasky]

The branch main has been updated by hselasky:

URL: https://cgit.FreeBSD.org/src/commit/?id=4eac63af23ddafc2b1dfb2aad2896f4513c37cdd

commit 4eac63af23ddafc2b1dfb2aad2896f4513c37cdd
Author:     Hans Petter Selasky <hselasky at FreeBSD.org>
AuthorDate: 2021-01-12 17:51:09 +0000
Commit:     Hans Petter Selasky <hselasky at FreeBSD.org>
CommitDate: 2021-05-21 12:59:19 +0000

    Fix for use-after-free by if_ioctl() calls from user-space in USB drivers by
    detaching the ifnet before the miibus.
    
    PR:             252608
    Suggested by:   jhb@
    MFC after:      1 week
    Sponsored by:   Mellanox Technologies // NVIDIA Networking
---
 sys/dev/usb/net/uhso.c         | 2 +-
 sys/dev/usb/net/usb_ethernet.c | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/sys/dev/usb/net/uhso.c b/sys/dev/usb/net/uhso.c
index c72fa8d7a36b..4ff5fcc075d3 100644
--- a/sys/dev/usb/net/uhso.c
+++ b/sys/dev/usb/net/uhso.c
@@ -691,10 +691,10 @@ uhso_detach(device_t self)
 		free_unr(uhso_ifnet_unit, sc->sc_ifp->if_dunit);
 		mtx_lock(&sc->sc_mtx);
 		uhso_if_stop(sc);
+		mtx_unlock(&sc->sc_mtx);
 		bpfdetach(sc->sc_ifp);
 		if_detach(sc->sc_ifp);
 		if_free(sc->sc_ifp);
-		mtx_unlock(&sc->sc_mtx);
 		usbd_transfer_unsetup(sc->sc_if_xfer, UHSO_IFNET_MAX);
 	}
 
diff --git a/sys/dev/usb/net/usb_ethernet.c b/sys/dev/usb/net/usb_ethernet.c
index e1eb2c247b5a..33659049f970 100644
--- a/sys/dev/usb/net/usb_ethernet.c
+++ b/sys/dev/usb/net/usb_ethernet.c
@@ -319,6 +319,12 @@ uether_ifdetach(struct usb_ether *ue)
 		/* drain any callouts */
 		usb_callout_drain(&ue->ue_watchdog);
 
+		/*
+		 * Detach ethernet first to stop miibus calls from
+		 * user-space:
+		 */
+		ether_ifdetach(ifp);
+
 		/* detach miibus */
 		if (ue->ue_miibus != NULL) {
 			mtx_lock(&Giant);	/* device_xxx() depends on this */
@@ -326,9 +332,6 @@ uether_ifdetach(struct usb_ether *ue)
 			mtx_unlock(&Giant);
 		}
 
-		/* detach ethernet */
-		ether_ifdetach(ifp);
-
 		/* free interface instance */
 		if_free(ifp);