svn commit: r268206 - in stable/10/sys/dev/usb: net serial

[Hans Petter Selasky]

Author: hselasky
Date: Thu Jul  3 06:44:55 2014
New Revision: 268206
URL: http://svnweb.freebsd.org/changeset/base/268206

Log:
  MFC r268078 and r268080:
  Fix for memory use after free() and mtx_destroy().

Modified:
  stable/10/sys/dev/usb/net/uhso.c
  stable/10/sys/dev/usb/serial/usb_serial.c
  stable/10/sys/dev/usb/serial/usb_serial.h
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/dev/usb/net/uhso.c
==============================================================================
--- stable/10/sys/dev/usb/net/uhso.c	Thu Jul  3 05:22:13 2014	(r268205)
+++ stable/10/sys/dev/usb/net/uhso.c	Thu Jul  3 06:44:55 2014	(r268206)
@@ -558,8 +558,6 @@ uhso_attach(device_t self)
 	mtx_init(&sc->sc_mtx, "uhso", NULL, MTX_DEF);
 	ucom_ref(&sc->sc_super_ucom);
 
-	sc->sc_ucom = NULL;
-	sc->sc_ttys = 0;
 	sc->sc_radio = 1;
 
 	id = usbd_get_interface_descriptor(uaa->iface);
@@ -679,9 +677,6 @@ uhso_detach(device_t self)
 				    UHSO_CTRL_MAX);
 			}
 		}
-
-		free(sc->sc_tty, M_USBDEV);
-		free(sc->sc_ucom, M_USBDEV);
 	}
 
 	if (sc->sc_ifp != NULL) {
@@ -709,6 +704,8 @@ static void
 uhso_free_softc(struct uhso_softc *sc)
 {
 	if (ucom_unref(&sc->sc_super_ucom)) {
+		free(sc->sc_tty, M_USBDEV);
+		free(sc->sc_ucom, M_USBDEV);
 		mtx_destroy(&sc->sc_mtx);
 		device_free_softc(sc);
 	}

Modified: stable/10/sys/dev/usb/serial/usb_serial.c
==============================================================================
--- stable/10/sys/dev/usb/serial/usb_serial.c	Thu Jul  3 05:22:13 2014	(r268205)
+++ stable/10/sys/dev/usb/serial/usb_serial.c	Thu Jul  3 06:44:55 2014	(r268206)
@@ -203,7 +203,7 @@ ucom_uninit(void *arg)
 
 	mtx_destroy(&ucom_mtx);
 }
-SYSUNINIT(ucom_uninit, SI_SUB_KLD - 2, SI_ORDER_ANY, ucom_uninit, NULL);
+SYSUNINIT(ucom_uninit, SI_SUB_KLD - 3, SI_ORDER_ANY, ucom_uninit, NULL);
 
 /*
  * Mark a unit number (the X in cuaUX) as in use.

Modified: stable/10/sys/dev/usb/serial/usb_serial.h
==============================================================================
--- stable/10/sys/dev/usb/serial/usb_serial.h	Thu Jul  3 05:22:13 2014	(r268205)
+++ stable/10/sys/dev/usb/serial/usb_serial.h	Thu Jul  3 06:44:55 2014	(r268206)
@@ -195,7 +195,7 @@ struct ucom_softc {
 #define	UCOM_MTX_LOCK(sc) mtx_lock((sc)->sc_mtx)
 #define	UCOM_MTX_UNLOCK(sc) mtx_unlock((sc)->sc_mtx)
 #define	UCOM_UNLOAD_DRAIN(x) \
-SYSUNINIT(var, SI_SUB_KLD - 3, SI_ORDER_ANY, ucom_drain_all, 0)
+SYSUNINIT(var, SI_SUB_KLD - 2, SI_ORDER_ANY, ucom_drain_all, 0)
 
 #define	ucom_cfg_do_request(udev,com,req,ptr,flags,timo) \
     usbd_do_request_proc(udev,&(com)->sc_super->sc_tq,req,ptr,flags,NULL,timo)