From nobody Wed Sep 02 09:39:28 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hZd3p3Qlwz6r0GF for ; Wed, 02 Sep 2026 09:39:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hZd3n74FRz3S76 for ; Wed, 02 Sep 2026 09:39:33 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788341974; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=X2gMods4hmyWZr6GeWq47+8QGC6jN7S30OPqtmjC+a0=; b=YTEFhaJFyEsO/cW7svnQuBC4HGLSV7zbZ8mTj+k8EyGEwv2LfvA2JREizVOJNSnfboiXEi F+Njvn1IvfX4f6kdzBMcNUlz/sCrgwI9Iz4J/s3TjrWYb0McEcJpy+XJsStV+btNYIxMH+ up3gYGE+QfWkLKkBVZdjbw0Z+M1NmPl4SlfsliAhnJLyW95KMCi5dCZBRh53uGLuBZHlzA kOJgH775h+pTIhYSokIi7j79gGQVfM4j33nvsVbgKKNiNWNnYWqFHH0mdoB0Aro/7Egp8e gzVXSfv85gYx6RtqHzR/+JRJBx5pBmc16AWP0W1qc0LeIJx9lgEwmUxbKzkGOQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788341974; a=rsa-sha256; cv=none; b=rRkMKKbZKd0TU+KFPtJmZsKo44MHZZnGM03Y04eg33OTBOypiZgNjKA+vzJM5nzUrZpE2s s8HqMSVsOxI5xaEdWlTq2YZ7xUw/wnGGjbCUEFhpBVmFb7O5QNIAsbW0e5WpYk+lULxcxt EhIWij0Y7FeXosUJrZhjiosKS1qC9e/IBM94voCaf/F6PaQlNkk+EteHsghm1+yxqZM5tm 3JgyHW3tPD7/Its1gcnBP329yENhb8vS6KBARg5rhTkfEFdvfeOAOEOwHiZF9D7s3YxN01 snVYFyK4F4q8OVCKzASvjCxk1a4fbNhqAdTrKXlT9LCyFNOAalXPpT0SeZgd6A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788341974; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=X2gMods4hmyWZr6GeWq47+8QGC6jN7S30OPqtmjC+a0=; b=bxeyJGEq/sstBShz8MM2U2pfz2XgDUKGZLM4O2v7ZOT+EcR8cDbseH33Bapntt+4ZvWlYm 98kj379ybw58HdDw/Q+RtGJ1hcUda5sN2L7oIyXkqvQWpuPSlRUZpu9nLY82IPqsbMMdX3 rLxGrHkJXxFrxqZLiYQkwL6ZkxO/g5VBqz5be8GfL59qQyVMeEeEoxt+giVlIHRspD8Ecx nFdD2YV+U7c4Qx2/2iSJnaS4b3I6D6fUF3iTA9Llm0vMCS6qeIFoanaQQ10iXF9wrCzf+H Q9MJ55Q3y1D+lv7YbDkAIebFUEBNTfW8Q6RDVUeTIbVNteZCZQmcMI1OJQfHmQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hZd3n5bYKzf5g for ; Wed, 02 Sep 2026 09:39:33 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 314b5 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 02 Sep 2026 09:39:28 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Xuqing Yang From: Christos Margiolis Subject: git: de60db7469f0 - stable/15 - bcm2835_audio: Comment out vchi_service_release() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: christos X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: de60db7469f057748435281d147143f3c8b35474 Auto-Submitted: auto-generated Date: Wed, 02 Sep 2026 09:39:28 +0000 Message-Id: <6a97eed0.314b5.25a588b4@gitrepo.freebsd.org> The branch stable/15 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=de60db7469f057748435281d147143f3c8b35474 commit de60db7469f057748435281d147143f3c8b35474 Author: Xuqing Yang AuthorDate: 2026-08-18 20:17:44 +0000 Commit: Christos Margiolis CommitDate: 2026-09-02 09:38:58 +0000 bcm2835_audio: Comment out vchi_service_release() bcm2835_audio_release() calls vchi_service_close() and then unconditionally calls vchi_service_release() with the same service handle. In the VCHI shim implementation, a successful vchi_service_close() calls service_free(service). The subsequent vchi_service_release() therefore dereferences a freed SHIM_SERVICE_T object when it reads service->handle, resulting in a use-after-free panic. vchi_service_release(), however, releases a reference which might block vchi_service_close() from completing successfuly, so comment it out instead of removing it altogether, until further testing is done. PR: 297187 MFC after: 2 weeks Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D58921 (cherry picked from commit 95c04b25323d59da43203a08e56db141ac37181b) --- sys/arm/broadcom/bcm2835/bcm2835_audio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/arm/broadcom/bcm2835/bcm2835_audio.c b/sys/arm/broadcom/bcm2835/bcm2835_audio.c index 0915bee677ef..8355fa62d21e 100644 --- a/sys/arm/broadcom/bcm2835/bcm2835_audio.c +++ b/sys/arm/broadcom/bcm2835/bcm2835_audio.c @@ -295,10 +295,10 @@ bcm2835_audio_release(struct bcm2835_audio_info *sc) int success; if (sc->vchi_handle != VCHIQ_SERVICE_HANDLE_INVALID) { + /* XXX vchi_service_release(sc->vchi_handle)? */ success = vchi_service_close(sc->vchi_handle); if (success != 0) printf("vchi_service_close failed: %d\n", success); - vchi_service_release(sc->vchi_handle); sc->vchi_handle = VCHIQ_SERVICE_HANDLE_INVALID; }