From nobody Sat Oct 17 21:38:06 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j6ZtD362mz6wqlf for ; Sat, 17 Oct 2026 21:38:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j6ZtD1pKMz55cV for ; Sat, 17 Oct 2026 21:38:12 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792273092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VNpVg7qEz9pEmdDWGT6LqN0WrmlFRaedHkCci1i4iAE=; b=Qdulu4dPlgT+O8KycjyJbmVjYMaa14NxV6RHyNbRWARV5S0I/suV6EoE481EmiI/bmFpZx 9BUGNmGhPkdhelLcsQIDsTBNvlEXMjNRd2JfRJ/bmntVcSzYCEpUTpZqUbwp4+X/WXytnc FO4swEtmSCkmIIS2JAxdseCIEAXuFWh/HHFr/pH5W8bGpYTcNteRrsayN81rXiIC4+ljxS LgrxZLr10fn2jmFro+W088gJK5+q+j/lpA4STLgdZGggki7oHFTn1NNdbqt7h7vr8i+xx/ 090vCe3rTw44YQfO4VAdxsH9TcdI6HS+Peiy+zXyW10m264wMSJm8ZaClqDQEg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792273092; b=VbZx+T5i4wwZZIGRhqlX9oWHJ4oN4XjhVWHd09utSJQW4mjzT1smX52XRRnEyU3PKFZJTe iWLztmB4qEdZ5YMrAWeWn1sYVOokTfMx6Jd5Y2R/bAkMzVgaNTwDuww0CVJNf9MmaIiIvF Tw92+wh7lpSsxhBy+v3HyeY1K4KrCfyzJdK/aBm78zejVPFf67s/BXAejWjxngwkObDzlS kSa5W4vnOs20/VvVf5fIkVCl6LO8Hjy79QgaBaFbJ3qikEsWgT/RVP7WVK/IVD0qFvTnv8 /HReRDiXPSmJnfewItCUAMRwcSsz7JS+3NdDPEW4sFlb2qjUQG+UjHgOtIxaEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792273092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=VNpVg7qEz9pEmdDWGT6LqN0WrmlFRaedHkCci1i4iAE=; b=XOZy/kSkwLc+n9RbE7QALYoLEcqcXARBytFQZoc4HSdBY73ZghtB6VZEoxW4uFXyThoSW0 x+A+a8tuhA83aaE1HQelwNOqoo4U6bF/dx9JNrH2VUKWFyMyD45QLdr8lrWSKA47hL+hfS qcta993So8ZXC6gA87PUm3ipmQcXOJDqQXM3w230sotZ1U7pFIW3oqhj1KE5HjPCnhHJj3 xhvLqDKBlbxf7PTr0I+8bHjyOzk/gF2u6wb22XtZfkJDW7alryTpYYQuJah77Qe3iBi57Q NiDJ/emjIbI9Ep99lfHze3hdpxw+T04aDH6J4WQMHoCGbMRD7OxcBhxweU0CLg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j6ZtD0qlnzKg1 for ; Sat, 17 Oct 2026 21:38:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3f021 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sat, 17 Oct 2026 21:38:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Adrian Chadd Subject: git: 37337c499474 - main - iwm: fix incorrect mutex / crash use during error detach path List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: adrian X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 37337c4994745b8143f240fd1b9f64c4255b58fc Auto-Submitted: auto-generated Date: Sat, 17 Oct 2026 21:38:06 +0000 Message-Id: <6ad3eabe.3f021.70c4ba6a@gitrepo.freebsd.org> The branch main has been updated by adrian: URL: https://cgit.FreeBSD.org/src/commit/?id=37337c4994745b8143f240fd1b9f64c4255b58fc commit 37337c4994745b8143f240fd1b9f64c4255b58fc Author: Adrian Chadd AuthorDate: 2026-10-17 21:31:45 +0000 Commit: Adrian Chadd CommitDate: 2026-10-17 21:31:45 +0000 iwm: fix incorrect mutex / crash use during error detach path My previous commit (b3ef4013a4) added a couple of lock assertions. However, the detach assertion is wrong - if the driver hasn't attached then detach needs to be a no-op and this includes not touching a deinit'ed mutex. So, move the mutex check and use until after the attached check. This fixes the driver crash I saw when another bit of in-flight work caused attach to fail, and thus iwm_detach() -> iwm_detach_local() ended up trying to use a deinit'ed mutex, leading to a crash. Fixes: b3ef4013a4fa75063930d0221a0bc50f95af0527 Differential Revision: https://reviews.freebsd.org/D60821 --- sys/dev/iwm/if_iwm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/sys/dev/iwm/if_iwm.c b/sys/dev/iwm/if_iwm.c index 083c316e118e..94963c17312c 100644 --- a/sys/dev/iwm/if_iwm.c +++ b/sys/dev/iwm/if_iwm.c @@ -7104,13 +7104,17 @@ iwm_detach_local(struct iwm_softc *sc, int do_net80211) device_t dev = sc->sc_dev; int i; - IWM_LOCK_ASSERT_UNLOCKED(sc); - - IWM_LOCK(sc); + /* + * Note: this is called during detach where the attach path + * didn't entirely attach all state. Thus mutexes may not + * be initialised here. + */ if (!sc->sc_attached) { - IWM_UNLOCK(sc); return 0; } + + IWM_LOCK_ASSERT_UNLOCKED(sc); + IWM_LOCK(sc); sc->sc_attached = 0; sc->sc_flags |= IWM_FLAG_STOPPED; IWM_UNLOCK(sc);